Privacy Statement

We are The Outward Bound Trust, an educational charity. We inspire young people to defy their limitations using learning and adventure in the wild. Everything we do is about working together with our customers and donors to have a positive impact on young people’s lives.

We are the Data Controller for the personal data that we process.

We are committed to keeping your personal data safe and secure, and to meeting the requirements of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communication Regulations 2003 (“PECR”) and any other laws that might apply.

We keep this Privacy Statement up to date to help you understand what we do with your personal data. This is version 6.0 of this document, and we last updated it on 02/11/2021.

1. YOUR DATA AND HOW WE USE IT

We protect your personal data and will never sell it to anyone.

1.1 General

We collect and process personal data to fulfil our charitable purpose. When we collect your personal data, we aim to be clear about our reasons for doing so, and we will only use it as you would reasonably expect.

In general, when you:

• visit our website
• communicate with us
• apply for or book a course with us
• take part in a course or event with us
• donate to us

at some point we will need to collect and use some of your personal data. We will do our best to keep your information up to date. Please let us know if your details change.

We want to be open, honest and fair in the way that we use your data. See section 4 of this Privacy Statement for your legal rights over your personal data.

If you aren’t yet a donor or customer, we might use publicly available data to help us to get to know you. This is in our legitimate interests as a charity dependant on fundraising and course bookings for income. You have the right to opt out of marketing and fundraising messages at any time.

We might also sometimes bring together information that you’ve already given us with data from publicly available sources, such as information about the area where you live. This is so we can better understand you as a young person, customer or donor. This then helps us to work and communicate more effectively. Again, this is in our legitimate interest as a charity.

We use carefully chosen suppliers to help us with specific tasks. This sometimes means we need to share some of your personal data with them. For example, this could be to make sure that you aren’t served food that you’re allergic to, or to send you an email newsletter that you’ve opted in to. Our contracts with our suppliers require them to only act on our instructions, to keep your data secure and to comply with data protection laws. We always keep control of your data.

If asked by the police, or other regulatory or government authority, we may be required by law to pass on your personal data to them, and we might not be allowed to tell you if this happens.

The rest of this Privacy Statement goes into more detail about what we do with your personal data depending on your relationship with us.

1.2 When you visit our website

When you use our website, we collect and process certain types of personal data and place some cookies on your device. For more details, please see the website privacy notice at https://www.outwardbound.org.uk/your-personal-data

1.3 If you are a course participant or applicant

We may be given some of your personal data by your school/college or employer, or from the person who booked your course. This information helps us to plan and prepare your course and accommodation, and usually includes:

• your name
• gender
• age
• and sometimes your school/college class or your job role.

We need you to fill in an enrolment and medical form before you take part in an Outward Bound course. This form might be online or might be on paper. On this form we collect some sensitive personal information, including:

• date of birth
• next of kin
• gender
• medical information, including allergies and medical conditions
• dietary information
• any other information you decide to tell us that helps us look after you.
• your contact details
• your (and your parent or guardian’s) preferences for receiving marketing messages from us
• your responses to any evaluation questions

This sensitive data is confidential, and we take extra care with it. We only use it to keep you and those around you safe and well. After your course, we need to look after this data for some time, along with other records about your time with us. This helps us to meet our legal responsibilities. We need to keep this information for at least three years after your course if you are over 18. If you are under 18, we need to keep it until you are at least 21 years old.

If you are completing an enrolment and medical form for someone else (such as your child), you should tell them that we will have their data and that they have rights relating to it. Show them this section of the Privacy Statement and help them to understand it.

We also collect:

• your contact details

We may need to send you important information about your course. You can’t opt out of receiving this type of message.

• your (and your parent or guardian’s) preferences for receiving marketing messages from us

You are in control of whether to receive marketing messages from us. Our marketing is done in line with our legitimate interests as a charity.

During or after your course we may also collect:

• your responses to any evaluation questions

This information is only used to evaluate and report on the impact of our work and is anonymised whenever possible.

• any feedback you give us

We use this information to keep improving our centres and courses. Feedback and evaluation information is used in line with our legitimate interests as a charity.

If you apply for a place on a funded programme (such as the Mark Scott Leadership for Life Award, or Scotland’s Next Generation), we will combine the information you give us with publicly available information about the area where you live. This helps us to allocate places effectively, to match you to a donor, and to help us report to our donors on how we use their money. We may also ask you to give us anonymous information about your background to help us explain to our donors how we use their money.

1.3.1 Working with your school, college or employer

If you come to us with your school, college or employer, we might need them to help us to make sure that enrolment and medical forms are completed by you and other people on your course. Your school, college or employer cannot see what you have entered on the form apart from your name. We do tell them whether you have completed the form or not.

Your school, college or employer may share other information about you with us, and we may share information with them about you. This is part of how we work in partnership to look after you before, during and after your time with us.

1.4 If you came on an Outward Bound course in the past

We keep an archive of historical courses, so if you came on a course with us in the past, we may have records of:

• your name, age and other basic information about you at the time
• photographs of you during your course
• your detailed course report and other paperwork from the course.

Exactly what information we have depends on when and where your course was. If your course was more than 10 years ago, to find out if we do have a record of your course in our archive, and to obtain copies of your records, please contact Dylan Carroll, Head of Legacy Giving, at dylan.carroll@outwardbound.org.uk.

See section 4 below if your course was less than 10 years ago and you want to obtain a copy of any personal data we hold.

1.5 If you are a donor, or a prospective donor

If you have donated to us, or if we consider you to be a prospective donor, the personal data we hold on you may include:

• your name and contact details
• your preferences on how to contact you
• your history of donations to us
• invoicing or Request for Donation information
• your job title and other information about the company you work for
• general information about your interests and business activities
• records of events you have attended with us
• your history of support for us
• records of your written communications with us.

We usually gather or generate this information in the course of setting up or fulfilling your donation agreement with us. If you are not yet one of our donors, we might have obtained some information from publicly available sources through our prospect research. This information is used in line with our legitimate interest as a charity reliant on fundraising. You always have the option to opt out of any messages we send you, and you can request at any time that we stop processing your data or delete it. See Section 4 of this Privacy Statement to find out how to do that.

We are registered with the Fundraising Regulator and comply with the Fundraising Code of Practice.

1.6 If you are a customer

If you have booked a course with us, we will usually hold the following information about you, in order to fulfil our contract with you and to manage your relationship with us:

• your name and contact details
• your job title and other information about your place of work
• your preferences on how to contact you
• your history of bookings with us
• invoicing information
• records of your written communications with us.
• your responses to any impact evaluation or feedback opportunities.

We gather this personal information directly from you during the booking process and throughout the course of your relationship with us.

During or after the course you booked, we may also collect:

This information is used to help us keep improving our courses and the way we work with you and other customers, or to evaluate and report on the impact of our work - in which case it is usually anonymised. We will always ask your permission if we want to use your name in any of our evaluation reports or marketing material. Evaluation and feedback is done in line with our legitimate interest as a charity.

1.7 If you are not yet one of our customers

We might have found basic information about you, including contact details, from publicly available sources. We use this to help us to get in touch with you. This is in line with our legitimate interest as a charity.

You might also have directly given us your information when you completed one of our forms, attended a course with us, or got in touch with us some other way.

From time to time, we may tell you about news, events, activities or offers which we think may be of interest to you. You can opt out of receiving these messages whenever you like.

We limit the number of marketing messages that we send, and we use profiling and segmentation to make sure that messages are relevant.

If you do not wish to receive marketing messages by post, phone, text or email, you can notify us to change any of your preferences at any time using the contact details in section 5 of this policy. All marketing emails that we send have unsubscribe links at the bottom to make it easy for you to opt out of receiving them.

2. How we look after your personal data

We protect your personal data and will never sell it to anyone.

We hold and process your personal data on The Outward Bound Trust’s computer and paper systems. We use our supplier’s systems for certain tasks. We continually improve our processes and systems. We consider data protection by default and by design.

2.1 Security

We take the security of data very seriously. We use third-party audit and certification programmes including Cyber Essentials Plus to test and improve the security of our systems. We operate Clean Screen and Clean Desk policies and encrypt portable devices. Our staff undergo DBS checks and data protection training before handling personal data. Access to personal data is strictly limited to those people who require it for their roles, and logins are secured with multi-factor authentication.

2.2 Suppliers

We use carefully chosen suppliers to help us with certain tasks. These include processing personal data for managing bookings, administering courses, and communicating with you. Occasionally this means that data is electronically transferred to, and stored at, a location outside the European Economic Area (“EEA”). We use Data Protection Agreements and other contractual arrangements including Standard Contractual Clauses to ensure your data is only processed on our instructions, in line with the law. We monitor the performance of our suppliers to ensure that our standards are maintained.

3. Changes to this statement

We make changes to this Privacy Statement from time to time as part of our commitment to continual improvement. The latest approved version of this policy will always be available on our website.

If we make any significant changes in the purposes that we use your personal data for, we will make this clear on our website or contact you directly.

Since the previous version (4.0):

• we have introduced a more sophisticated cookie management tool for our website. As part of this we have moved information about website privacy into a new document, with details about the individual cookies we use and other data processing that we do using data recorded by our website systems. The new website privacy notice can be found at https://www.outwardbound.org.uk/your-personal-data.
• We have stopped using paper medical and enrolment forms. All pre-course participant information is now collected solely electronically.

4. Your data rights

You have the following rights relating to your personal data. If you want to exercise any of your data rights, just get in touch with us using the details in Section 5 below. We may need to check that you are who you say you are, to keep your data safe.

1. The rights to know what data we hold about you, what we use it for, and to request a copy of personal information held about you
2. The right to request that any inaccuracies be corrected
3. The rights to request us to stop processing your personal data and to request us to delete your personal data
4. The right to complain to the Information Commissioner’s Office or the Fundraising Regulator

We will provide this information within one month. It will help us if you can be specific about the types of data you would like a copy of.

We will usually be able to do this immediately, although in some circumstances it might take us up to one month to complete your request.

There might sometimes be good reasons why we need to keep some data, even if you have asked us to delete it. For example, if you have asked us not to send emails to you, we will need to keep your email address to check against so that we don’t accidentally send you emails in future.

You can do this at any time. The Information Commissioner’s Office can be found at ico.org.uk and the Fundraising Regulator can be found at fundraisingregulator.org.uk

5. Contact Us

Please get in touch if you have any questions about this policy, would like us to stop sending you messages or using your data, or if you would like to exercise any of your personal data rights.

Telephone: 01931 740 000

Email: enquiries@outwardbound.org.uk

Address: The Outward Bound Trust, Hackthorpe Hall, Hackthorpe, Penrith, Cumbria, CA10 2HX.

5.1 Data Protection Officer

Our Data Protection Officer is John Chivall, Quality and Compliance Manager.

Email: john.chivall@outwardbound.org.uk