The Summer Jobs Programme

Summer Jobs Programme: Privacy notice

Catch22 is a national organisation that works across England and Wales delivering services in a variety of settings. These include schools, colleges, social care, victim services, family support, prisons, apprenticeships and employment support.

We have been around for over 200 years and our focus is about making a difference to people by delivering our 3 ‘P’s – having good people around, having a good place to live/study/work, and having good purpose in life. Different services will focus on different aspects but we aim to address those three elements to support people to thrive.

What does this service do?

The Summer Jobs Programme is for 16–20-year-olds who are at risk of violence or face other significant risks to employment. The programme will be run during the summer holidays and includes a preparation week and a 5-week paid work experience placement with a local employer (25 hours per week – £12.21 per hour). The programme aims to combat the barriers that many Young People face in gaining employment by fostering career development, personal growth, and positive engagement. It is specifically designed to reduce the risk of youth violence by providing structured opportunities that empower young people and build brighter futures.

What information do we collect and why do we need it?

So that we can provide you with a service we will need to collect some information about you. Some things will be obvious but if you have any queries about any of the information we ask you for or why we need it then please ask us. The list below covers the key things we will ask for:

• Your personal details, such as full name, email address, date of birth, address and contact details.

We may ask you to give us some more sensitive information (also known as ‘special data’) like your gender, age, ethnicity, sexual orientation, religion and/or any disabilities. We will explain to you why we need this information and you are free to refuse to give it if you do not wish to do so. We need your information for us to remain in contact with you and to keep accurate records of the support you are receiving from or through the Summer Jobs Programme.

What law applies and sets out the legal basis for us to collect and hold your information?

Under data protection law, we must have a lawful basis for using your information. The lawful bases we rely on to deliver the Summer Jobs Programme are set out below. Personal data (Article 6 UK GDPR).

We process your personal information because it is necessary to:

• Article6(1)(b) –Performance of a contract To deliver your participation in the Summer Jobs Programme, including preparation activities, your paid work placement, and ongoing support.
• Article6(1)(c)–Legal obligation To meet our legal duties, including employment, payroll, safeguarding, and reporting requirements.
• Article 6(1)(e) – Public task Where the programme is delivered as part of publicly funded or commissioned activity aimed at supporting young people into employment and reducing the risk of harm.
  We do not rely on consent as the main lawful basis where processing is necessary to deliver the programme or meet legal obligations.

Special category data (Article 9 UK GDPR)

Some of the information we may collect is more sensitive (for example, information about health, ethnicity, disability, or safeguarding needs).

We process this information because it is necessary for:

• Article 9(2)(g) – Substantial public interest, together with Schedule 1 of the Data Protection Act 2018, where processing is needed to safeguard children and young people or individuals at risk, and to deliver support safely and appropriately.

Where we ask for equality and diversity monitoring information, this is voluntary, and we rely on:

• Article 9(2)(a) – Explicit consent
  You can choose not to provide this information without it affecting your involvement in the programme.

Safeguarding and Risk Information
Where information is processed to protect your safety or the safety of others, including where there are concerns about harm or risk, we may share information with appropriate safeguarding agencies in line with the Data Protection Act 2018 and safeguarding law.

If you provide us with information about the suspect/offender as part of our service to you, we are able to use that under the Data Protection Act 2018 Part 2 (14) of Schedule 1 where information is gathered for the provision of confidential advice or support to you.

The Information Commissioner’s Office has given further guidance that sets out when these conditions can be used as the legal basis for processing your information and this can be supplied to you if you wish to see it.

Where do we get your data from?

The majority of the information we hold comes from you. Additionally though, we will hold information that has come from other organisations that may have referred you to our service with your consent, including:

• Local DWP job centres, youth providers, outreach teams, education providers, specialist employability services, the police etc. This list is not exhaustive.

It is important to note that we will only contact you where we know that that you have given your explicit consent to the referring agency before they passed on your information to us.

Who will we share your information with?

We will only share information about you where it is necessary to deliver the Summer Jobs Programme, to keep you or others safe, or where we are legally required to do so.

We may share relevant information with safeguarding organisations, such as Children’s or Adult Social Care, the Police, or other emergency services, where there are concerns about your safety or the safety of others. In these circumstances, only the minimum information necessary will be shared, and this will be done in line with the Data Protection Act 2018 and safeguarding law.

We may be required to share information with the Police where they are carrying out a lawful investigation. Any such disclosure will be limited to what is necessary and proportionate.

We share information with **UK Youth** and **IFF Research** for programme monitoring, evaluation, and reporting purposes.

Where possible, information shared for evaluation purposes will be anonymised or pseudonymised. UK Youth and IFF Research act either as data processors on our behalf or as independent data controllers for their own statutory and research purposes, depending on the nature of the activity. Further information about how they use your data can be provided on request.

As part of delivering a paid work placement, we will process and share information necessary to pay you correctly and meet our legal obligations.

This may include sharing relevant information with payroll providers, HM Revenue & Customs (HMRC), and other organisations where required by law, for example for tax, National Insurance, right-to-work checks, and financial reporting.

We will only share the minimum information required for these purposes and will ensure that appropriate safeguards are in place.

How long will we hold on to your information for?

Your personal information will be held for the period of time that your involvement with the Summer Jobs Programme is active. After your participation ends, we will normally retain your personal information for up to two years so that we can:

• provide further support if you return to the service, and
• meet our reporting and accountability requirements to programme funders and commissioners.

Information used for monitoring, evaluation, and research purposes may be retained for longer periods where this is necessary and lawful. Where possible, this information will be anonymised or pseudonymised so that you are no longer identifiable.

In some cases, we may be required by law to retain certain information for longer periods, for example in relation to financial, employment, or safeguarding records. Where this applies, we will retain the information only for as long as required and in line with legal and regulatory requirements.

What happens if the information in the records is wrong?

You will need to be specific about what information you think may be wrong and why, along with what you think we should do to correct it. If you can prove the information is incorrect, we will change it. If we cannot amend your record in the way you would like, we will explain the reason for this. You will be able to see a copy of your amended record.

What rights do you have over the information that we hold on your behalf?

You have a number rights over your data that we are required by law to uphold. You have the following rights:

• The right to be informed – How we will use your information
• The right of access – How to access information we hold about you
• The right to rectification – Request that information that is held about you and is inaccurate or incomplete be rectified
• The right to erasure – Requests that under special circumstance information held on you may be removed or deleted
• The right to restrict processing – Block or suppress processing of information about you
• The right to data portability – Obtain and re-use information held about you for your own purposes across different services
• The right to object – Object to processing of information about you
• The right to withdraw consent – At any time where your information is being processed based on that consent, you can withdraw your consent and processing cease
• The right to lodge a complaint with the Information Commissioners Office (ICO)

Young People (Under the age of 18)

• The Summer Jobs Programme is open to young people aged 16–20. Where participants are under the age of 18, we take additional care to ensure that personal information is handled appropriately and in line with safeguarding responsibilities.
• We will assess a young person’s ability to understand how their information is used and to exercise their data protection rights. Where appropriate, and particularly where there are safeguarding concerns, we may involve parents, carers, or other responsible adults, or share information with safeguarding agencies.
• Where information is processed to protect a young person’s safety or welfare, this will be done under our safeguarding duties and relevant data protection law, and not solely on the basis of consent.

If you would like to request a copy of the information we hold about you, please contact DPO@catch-22.org.uk.

If you think the information we hold on you is wrong, please contact DPO@catch-22.org.uk.

If you have any questions about this privacy policy or of our treatment of your personal data, email dpo@catch-22.org.uk or write to:

Data Protection Officer
Catch22
27 Pear Tree Street
London
EC1V 3AG

If you feel that we have not processed your data correctly and in accordance with GDPR and the Data Protection Act 2018, you have the right to make a complaint to the

Information Commissioners Office (body that regulates Data Protection). Please visit https://ico.org.uk/ or call 0303 123 1113 in order to lodge a complaint with the regulator.

Privacy notice

How we manage your data

Catch22 Charity Ltd. manages the data you provide in accordance with the EU General Data Protection Regulation (GDPR).

• The Data Controller (the organisation that determines how your data is managed) is Catch22. Contact us if you have a query about how your data is managed.
• The Data Processor (the organisation that does data processing on behalf of Catch22) is Totally.Tech.
• We are committed to giving you (the Data Subject in legal terms) an easy way to exercise your eight rights under the GDPR.
• We retain your data for as long as you allow us to do so. You can exercise your right to erasure at any time however, there may be some instances where we need to retain your information for a longer duration for legal reasons, such as when applying for a job with Catch22.
• Catch22 uses Click4Asistance as an online chat tool. By providing information, you consent to Click4Assistance collecting and processing this information according to their privacy policy. 

What information do we collect?

Catch22 may collect, store and use the following kinds of personal data:

• information about your computer and your visits to and use of this website, including your IP address, geographical location, browser type, referral source, length of visit and number of page views (cookies),
• information that you provide to us for the purpose of applying for a job or receiving job alerts (job applications / job alerts),
• subscribing to email newsletters including your name and email address (email newsletter),
• If using our online chat service Click4Assistance, information such as IP addresses, and chat transcripts will be collected. If you choose to provide them, personal data such as names, email addresses will be collected, or
• information that you submit that relates to a complaint, service feedback or enquiry (complaints / feedback and enquiries).

Specific detail of each processing activity is provided below.

Cookies

Cookies are text files that are stored on your web browser by a website’s server. Each cookie is unique to your browser, and will contain some anonymous information such as a unique identifier and the website domain name. This information is sent back to the server each time your browser requests a page from it. This enables the website server to identify and track your web browser via your unique, anonymous, identifier.

Catch22 only uses cookies on its website where they will support the functioning of its website and to improve the experience of its website visitors. These cookies may be created by Catch22’s website, or by third-party services that Catch22 uses, to enable its website to be run effectively.

Some, ‘necessary’ cookies are essential to the running of our website and are exempt from the requirement of consent as per the GDPR and PECR. Functional, analytical and advertising cookies are all optional, and we will only store these cookies on your browser where we have received your freely-given, specific, informed, and unambiguous consent.

Any information that is collected by Catch22 via cookies is processed in a way which does not, and cannot, identify an individual person. We do not make any attempt to find out the identities of those visiting the Catch22 website.

You can find out more about Catch22’s use of cookies, and how to opt-out of or delete cookies from your browser via our Cookies Statement.

Job applications

If you apply for a job with Catch22 using our hosted online job application system, this service will be provided by a data processor on our behalf (SmartRecruiters).

To process your application, we ask for your personal details including name and contact details. We will ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. The hiring managers for the role, along with our Recruitment and HR teams will have access to all of this information.

Catch22 processes your job application data for the purpose of its legitimate interest to process your HR information.

• If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus six years following the end of your employment.
• If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for six months from the closure of the campaign.
• Equal opportunities information is retained for six months following the closure of the campaign whether you are successful or not.

For more information, please see the SmartRecruiters privacy notice.

Job alerts

Through the SmartRecruiters job application system, it is also possible to sign up for job alerts, which will let you know when new jobs that meet your criteria have been posted.

These alerts are managed by the data processor (SmartRecruiters) on our behalf, and will only be processed using your freely-given, specific, informed and unambiguous consent.

If at any point you wish to unsubscribe from SmartRecruiters job alerts, this can be done by clicking the unsubscribe link on the latest email. You can also log into your SmartRecruiters candidate profile to modify or withdraw your details.

For more information, please see the SmartRecruiters privacy notice.

Email newsletter

If you subscribe to Catch22’s newsletter and/or event mailing lists, you will receive regular communications relating to our work. These mailings will be facilitated by a third-party provider, such as Mailchimp or Salesforce (marketing platforms), and your data will be processed by a third-party client relationship management platform, Salesforce.

Catch22 will only process your contact details and send you newsletters following your freely-given, specific, informed and unambiguous consent.

You have the right to unsubscribe from any of our email mailing lists at any time. If you wish to unsubscribe from a Catch22 mailing list please click the unsubscribe link on the latest email or contact dpo@catch-22.org.uk to ensure that you do not continue to receive email newsletters from us. We will need to continue to hold your details after you have unsubscribed to ensure that we do not send you further communications.

For more information, please see the Mailchimp or Salesforce privacy notices as appropriate.

Feedback and enquiries

Catch22 processes the data submitted through any of our website contact forms for the purpose of receiving your message and responding to it under the lawful basis of consent, which you give when submitting the form.

We will only use the information supplied to us to deal with the enquiry and any subsequent issues, and to check on the level of service we provide.

These contact forms are processed using the WordPress plugin, Gravity Forms. When these forms are submitted to us, notification emails are automatically generated to send your enquiry to the appropriate team within Catch22 who will store your email for as long as is required to deal with your enquiry and any subsequent issues.

Form submissions are also stored within the Catch22 WordPress database for a period of 90 days. This allows us to identify if there are any issues with forms being received by our teams. After this time, forms and all accompanying personal data are automatically deleted from the system. Gravity Forms does not receive copies of any of forms, or any accompanying personal data, that are submitted via the Catch22 website.

If using our online chat service, Click4Assitance, data collected through the chat service may be shared internally within Catch22  to provide support and improve services. 

You have the right to withdraw consent for us to contact you at any time by contacting dpo@catch-22.org.uk. You also have the right to lodge a complaint with a supervisory authority, which in the United Kingdom is the Information Commissioner’s Office.

For more information, please see the Gravity Forms privacy notice.

Complaints

Complaints can be submitted using our online feedback form, by emailing feedback@catch-22.org.uk, or by post. Catch22 undertakes the processing of your complaints data as part of its legitimate interests.

When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for six years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘data minimisation’ principle.

For more information, please see the Complaints, Compliments and Feedback policy.

Donations

Donations made through our website are processed securely via PayPal. By making a donation, you confirm that you are 18 or over and that the payment details you provide are your own. All donations are final and non-refundable, unless required by law. Please check your information carefully before completing your donation. Once your donation has been processed, you’ll receive confirmation via email from PayPal.

Your donation will help Catch22 continue its work across our programmes and services. Unless stated otherwise, donations will be used where they are needed most to support our charitable objectives. If a specific project or appeal becomes fully funded or cannot proceed, we may use your donation for a similar purpose to achieve the same charitable outcomes.

When you make a donation, we collect and process your personal information in line with our Privacy Policy. This includes your name, contact details, and payment information, which is processed securely by PayPal on our behalf.

Use of data processors

The Data Processor (the organisation that does data processing on behalf of Catch22) is Totally.Tech.

Catch22 also works with third-party data processors to provide our:

• content management system (WordPress),
• website analytics (Google Analytics and Microsoft Clarity),
• marketing platform (Mailchimp),
• client relationship management platform (Salesforce),
• social media advertising campaigns (Meta Pixel, Twitter Pixel, LinkedIn Insight Tag, TikTok Pixel),
• online chat service (Click4Assitance), and
• recruitment service (SmartRecruiters).

We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it and retain it for the period we instruct.

Individual Catch22 services may work with additional third-party data processors in line with their contractual requirements. For more information, please see the relevant Service Privacy Notice, which can be downloaded from their service page on this website, or found by searching for the service by name in our Policy Library.

Disclosures

Catch22 may disclose information about you to any of our employees, officers, agents, suppliers or data processors insofar as reasonably necessary for the purposes as set out in this privacy notice.

In addition, we may disclose information about you:

• to the extent that we are required to do so by law,
• in connection with any legal proceedings or prospective legal proceedings, or
• in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).

Except as provided in this privacy notice, Catch22 will not provide your information to third parties without your consent.

Security of your personal data

Catch22 will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

We will store all the personal information you provide on our secure, encrypted password and firewall protected servers. As data transmission over the internet is inherently insecure, we cannot guarantee the security of data sent over the internet.

Where information is held on our behalf by data processors, we will ensure, to the best of our ability, that they hold your information securely and in line with data protection legislation. We hold contracts with all data processors to make sure that they cannot do anything with your data unless we have instructed them to do so.

Notice amendments

We may update this privacy notice from time-to-time. Check this page occasionally to ensure you are happy with any changes.

Your rights

Please contact the Data Protection Officer if you have any queries regarding this Privacy Notice or if you would like to exercise or query any of the following rights afforded to you under the General Data Protection Regulation (GDPR):

• right to access
• right to erasure
• right to object
• right to rectification
• right to be informed
• right to restrict processing
• right to data portability
• rights in relation to automated decision making and profiling
• right to lodge a complaint with the Information Commissioners Office (ICO) – via the Complaints page on the ICO website or by calling 0303 123 1113

For further information on your rights, please visit the Individual Rights page on the ICO website.

Contact

If you have any questions about this privacy notice or of our treatment of your personal data, please email dpo@catch-22.org.uk or write to:

Data Protection Officer

Catch22
27 Pear Tree Street
London
EC1V 3AG

Data controller

Catch22’s data protection registration number is Z1473239