1. Who we are
YHA (England & Wales) is one of the UK’s leading charities for young people, providing a wide range of hostel accommodation and programmes. Our aim is to improve health, wellbeing and life skills through travel and real adventure.
YHA (England & Wales) is a data controller and a data processor in terms of the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018 and is registered with the Information Commissioner’s Office (ICO).
• ICO registration Number: Z6434257
• Company Registration Number: 282555
• Registered Charity Number: 306122
2. How and when we collect and use your information
Information about you will be collected by YHA (England & Wales) from you directly, from relevant third parties where we either have a legal obligation or you have provided your consent.
This information is collected through a range of communication channels at various stages and used throughout your relationship with YHA, including:
• When you apply for a role
• When you accept a role and complete the onboarding process
• During your employment or volunteering placement, including employee communications
• For a relevant period after your employment or placement
3. What personal information we collect and process
YHA (England & Wales) may collect, process and retain the following types of personal data about you:
• Name and contact information (address, email and telephone number)
• Emergency contact details
• Information provided on your application and gathered during the selection process (for any roles you apply for at YHA)
• Your bank or building society details
• Your National Insurance and Tax details
• Date of Birth
• Your Nationality and details of your Right to Work in the UK
• Proof of your identity, including a copy of your Passport
• Your pension arrangements
• Details of referees provided by you and copies of any references we obtain
• A photograph for identification purposes
• Your attendance, conduct and performance records
• Salary, benefits and contractual information
In addition, YHA will process the following sensitive personal data, which we will take additional measures to protect on your behalf:
• Medical information including physical or mental health, and sickness and absence records
• Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs
• Criminal records information, including the results of Disclosure and Barring Service (DBS) checks
• Your trade union membership
4. Why we collect your information
We will typically collect and use this information for the following purposes (other purposes that may also apply are explained in our data protection policy):
• for the performance of a contract (if an employee) or agreement (if a volunteer) with you, or to take steps to enter into a contract or agreement;
• for compliance with a legal obligation (e.g. our obligations to you as your employer under health safety legislation);
• for the purposes of our legitimate interests (e.g. business-related communications to employees or volunteers)
We seek to ensure that our information collection and processing is always proportionate. We will notify you of any material changes to information we collect or to the purposes for which we collect and process it.
5. How long we keep your information
We retain your personal information for as long as it is needed for the purposes set out above. This will usually be for the entirety of your employment or active volunteering with YHA, and for a period of up to 7 years afterwards as is required to comply with our legal obligations.
When your information is no longer required, we will delete it securely.
6. How we keep your information safe
We follow good security practices (including appropriate technical and organisational measures) in the processing, storage and disclosure of information which you have given us.
Our security procedures mean that we will need to confirm your identity before we are able to discuss your employment or volunteer placement data.
7. Information about young people
We welcome young people to volunteer and undertake work experience with YHA and are required to capture relevant personal information to enable this. We take extra care when handling information about young people.
We use Closed Circuit Television (CCTV) at some of our properties, and you may be recorded when you visit them.
We use CCTV in order to help protect YHA guests, employees, volunteers and visitors, and to protect YHA’s premises from criminal activities. CCTV footage will only be viewed when necessary – for example to detect a crime.
We comply with the ICO’s Code of Practice on the use of CCTV.
9. Disclosing your information to other organisations
We may use trusted third parties to process your information on our behalf and when we do, appropriate data privacy contracts will be in place. We will only transfer your personal information on the understanding that the third party has undertaken to us that they have in place adequate technical and organisational measures to protect that information.
The data that we collect from you may be transferred to, processed or stored at, a trusted third party destination outside the European Economic Area (“EEA”).
We will share your personal information with third parties including the police or other authorities where we are under a legal obligation to do so.
10. Your rights
You may, at any time:
• Ask us what information we hold about you and what we are doing with it
• Request copies of the information we hold about you
• Ask us to correct your information if it is inaccurate
• Request that we delete your information
• Ask us to change the way we process your information
• Object to our processing of your information
In certain circumstances your request may be declined or limited where YHA has legal reasons to retain or process this data.
11. How to get in touch
Your request should be made in writing and you will be required to prove your identity before a personal data request is actioned.
12. What to do if you have a complaint
If you have a question or complaint, please contact our Data Protection Compliance Officer in the first instance. If you are unsatisfied with the outcome, you may then inform the Information Commissioner at ico.org.uk/concerns/ or telephone: 0303 123 1113.