Privacy Policy

<p>My Student Years CIC is a Community Interest Company, private company limited by guarantee without share capital, registered in Scotland (Company Number SC735047). Our registered office is at 48 West George Street, Office 2/3, Glasgow, Scotland, G2 1BP.</p>

<p>We provide educational support services to students, including study skills, employability support and life skills development, delivered through a combination of online and in-person methods.</p>

<p>For the purposes of UK data protection law, My Student Years CIC is the Data Controller in respect of the personal data we collect and process. We are registered with the Information Commissioner’s Office (ICO) as required by law.</p>

<p>If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:</p>
<ul>
<li>Email: <a href=”mailto:info@mystudentyears.org”>info@mystudentyears.org</a></li>
<li>Post: 48 West George Street, Office 2/3, Glasgow, Scotland, G2 1BP</li>
</ul>

<hr />

<h2>2. Legal Framework</h2>

<p>This Privacy Policy is governed by:</p>
<ul>
<li>The UK General Data Protection Regulation (UK GDPR)</li>
<li>The Data Protection Act 2018 (DPA 2018)</li>
<li>The Privacy and Electronic Communications Regulations 2003 (PECR)</li>
<li>The ICO’s Children’s Code (Age Appropriate Design Code)</li>
</ul>

<hr />

<h2>3. What Personal Data We Collect</h2>

<h3>3.1 Basic Contact and Identity Information</h3>
<ul>
<li>Full name</li>
<li>Email address</li>
<li>Phone number</li>
<li>Date of birth (where relevant to determine age)</li>
</ul>

<h3>3.2 Academic and Educational Information</h3>
<ul>
<li>Educational background and qualifications</li>
<li>Current course or institution</li>
<li>Learning goals and progress information</li>
</ul>

<h3>3.3 Special Category Data</h3>
<p>We may collect the following categories of special category data, which require a higher level of protection under UK GDPR Article 9:</p>
<ul>
<li>Mental health and emotional wellbeing information</li>
<li>Information about disabilities or health conditions that may affect learning</li>
</ul>

<h3>3.4 Financial and Circumstantial Information</h3>
<ul>
<li>Financial circumstances where relevant to accessing support</li>
<li>Employment status and history</li>
</ul>

<h3>3.5 Technical and Usage Data</h3>
<p>When you use our website or digital services, we may automatically collect device information, IP address, browser type, and information about how you interact with our online services.</p>

<hr />

<h2>4. How We Collect Your Personal Data</h2>

<p>We collect personal data in the following ways:</p>
<ul>
<li>Directly from you when you register with us or use our services</li>
<li>Through our website (<a href=”https://www.mystudentyears.org”>www.mystudentyears.org</a>) via forms and cookies</li>
<li>Through in-person sessions and workshops</li>
<li>Through digital communication platforms used to deliver our services</li>
</ul>

<hr />

<h2>5. Our Lawful Basis for Processing</h2>

<p>We rely on the following lawful bases under UK GDPR Article 6:</p>
<ul>
<li><strong>Consent (Article 6(1)(a))</strong> — where you have freely given, specific, informed and unambiguous consent to us processing your personal data. You have the right to withdraw consent at any time.</li>
<li><strong>Contract (Article 6(1)(b))</strong> — where processing is necessary to deliver a programme or service you have enrolled in.</li>
<li><strong>Legal obligation (Article 6(1)(c))</strong> — where we are required by law to process your data, for example in connection with our safeguarding duties.</li>
<li><strong>Legitimate interests (Article 6(1)(f))</strong> — where processing is necessary for the purposes of our legitimate interests, provided those interests are not overridden by your rights and freedoms. We rely on this basis for service evaluation and quality improvement, internal reporting and administration, reporting to funders or commissioners in anonymised or aggregated form, and maintaining the security and integrity of our services. Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment (LIA).</li>
</ul>

<p>For special category data (such as mental health or wellbeing information), we rely on UK GDPR Article 9(2)(a) — your explicit consent — unless a safeguarding situation requires us to act without consent under Article 9(2)(b) (vital interests) or another applicable condition.</p>

<blockquote><strong>Important:</strong> We do not rely on legitimate interests when processing the personal data of children or young people under 18 for any purpose that could affect their wellbeing, rights, or interests. For those individuals, we rely on consent or another appropriate lawful basis.</blockquote>

<hr />

<h2>6. Children and Young People</h2>

<p>Our services are available to both adults and young people under the age of 18. We take additional care when processing the personal data of children and young people in accordance with the ICO’s Children’s Code.</p>
<ul>
<li>For children under 13, we will seek verifiable parental or guardian consent before processing their personal data.</li>
<li>For young people aged 13 to 17, we will use age-appropriate language and explanations and will consider whether parental consent is appropriate.</li>
<li>We will never use the personal data of children for profiling, behavioural advertising, or any purpose that could be detrimental to their wellbeing.</li>
</ul>

<p>A separate <a href=”/young-persons-privacy-notice”>Privacy Notice written for young people aged 13 to 17</a> is also available.</p>

<hr />

<h2>7. Safeguarding</h2>

<p>As an organisation working with young people and vulnerable individuals, we have safeguarding obligations. In certain circumstances, we may be required to share personal data — including without your consent — where we believe there is a risk to the safety or welfare of a child or vulnerable adult. Any such disclosure will be handled in accordance with our Safeguarding Policy and applicable legal obligations.</p>

<p><strong>Our Designated Safeguarding Lead (DSL) is Sally Brown.</strong> If you have a safeguarding concern, or if you are a young person who needs support, you can contact Sally directly:</p>
<ul>
<li>Email: <a href=”mailto:info@mystudentyears.org”>info@mystudentyears.org</a> (marked for the attention of the Designated Safeguarding Lead)</li>
<li>Post: 48 West George Street, Office 2/3, Glasgow, Scotland, G2 1BP</li>
</ul>

<hr />

<h2>8. How We Use Your Personal Data</h2>

<p>We use your personal data for the following purposes:</p>
<ul>
<li>To deliver educational support services and programmes</li>
<li>To communicate with you about your participation and progress</li>
<li>To tailor our support to your individual needs</li>
<li>To monitor and evaluate the effectiveness of our services</li>
<li>To comply with our legal and safeguarding obligations</li>
<li>To send you information about our services and activities where you have consented to receive this</li>
</ul>

<p><strong>We will never sell your personal data to third parties or use it for commercial advertising purposes.</strong></p>

<hr />

<h2>9. Sharing Your Personal Data</h2>

<p>We may share your personal data with the following categories of third parties:</p>
<ul>
<li>Technology service providers who process data on our behalf (see Section 10), under written Data Processing Agreements</li>
<li>Statutory agencies such as social services or the police, where we have a legal obligation or safeguarding duty to do so</li>
<li>Funders or commissioners of our services, where required and only in anonymised or aggregated form unless you have separately consented</li>
</ul>

<hr />

<h2>10. Third Party Data Processors</h2>

<p>We use the following third party systems to store and process personal data. Each is engaged under a written Data Processing Agreement:</p>
<ul>
<li>WordPress — website hosting and content management</li>
<li>Other CRM, cloud storage and email platforms as adopted from time to time — this policy will be updated to reflect any changes</li>
</ul>

<blockquote><strong>Important note regarding WhatsApp:</strong> We are aware that some communication with service users may occur via WhatsApp, which is operated by Meta Platforms Inc. (US). WhatsApp is not approved for the transmission of sensitive or special category personal data. We are reviewing our communication practices to ensure all sensitive data is handled through appropriately secure and compliant channels.</blockquote>

<hr />

<h2>11. International Data Transfers</h2>

<p>Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place:</p>
<ul>
<li>Transfers to the European Economic Area (EEA) are covered by the UK’s adequacy regulations recognising EU data protection standards</li>
<li>Any transfers to other countries will be made only where appropriate safeguards exist, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanism</li>
</ul>

<hr />

<p>We will retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:</p>
<ul>
<li>Contact and participation records: 3 years from the end of your engagement with our services</li>
<li>Financial records: 7 years, as required by HMRC</li>
<li>Safeguarding records: In accordance with statutory guidance, which may be significantly longer</li>
<li>Records relating to young people: Until the individual reaches the age of 25, or longer if required by safeguarding guidance</li>
</ul>

<hr />

<h2>13. Your Rights</h2>

<p>Under UK GDPR, you have the following rights in relation to your personal data:</p>
<ul>
<li><strong>Right of access (Article 15)</strong> — to obtain a copy of the personal data we hold about you</li>
<li><strong>Right to rectification (Article 16)</strong> — to have inaccurate data corrected</li>
<li><strong>Right to erasure (Article 17)</strong> — to request deletion of your data in certain circumstances</li>
<li><strong>Right to restriction of processing (Article 18)</strong> — to request that we limit how we use your data</li>
<li><strong>Right to data portability (Article 20)</strong> — to receive your data in a structured, commonly used format</li>
<li><strong>Right to object (Article 21)</strong> — to object to processing based on legitimate interests</li>
<li><strong>Right to withdraw consent</strong> — at any time, where consent is the lawful basis for processing, without affecting the lawfulness of prior processing</li>
</ul>

<p>To exercise any of these rights, please contact us at <a href=”mailto:info@mystudentyears.org”>info@mystudentyears.org</a>. We will respond within one calendar month. There is no charge for making a request.</p>

<hr />

<h2>14. Right to Complain to the ICO</h2>

<p>If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), which is the supervisory authority for data protection in the UK:</p>
<ul>
<li>Website: <a href=”https://www.ico.org.uk” target=”_blank” rel=”noopener”>www.ico.org.uk</a></li>
<li>Telephone: 0303 123 1113</li>
<li>Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF</li>
</ul>

<p>We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.</p>

<hr />

<h2>15. Cookies</h2>

<p>Our website uses cookies to improve your experience. We will only place non-essential cookies on your device with your consent, in accordance with PECR. You can manage your cookie preferences through your browser settings or our cookie consent tool. A full <a href=”/cookie-policy”>Cookie Policy</a> is available on our website.</p>

<hr />

<h2>16. Changes to This Policy</h2>

<p>We may update this Privacy Policy from time to time. Where changes are significant, we will notify you directly. The current version will always be available on our website and from our office on request.</p>

<p><em>My Student Years CIC • Company No. SC735047 • 48 West George Street, Office 2/3, Glasgow, G2 1BP • <a href=”mailto:info@mystudentyears.com”>info@mystudentyears.com</a> • Last updated: May 2026</em></p>