Young Enterprise NI Privacy Notice

Young Enterprise NI (YENI) is a data controller for the personal information it determines the purposes and means of processing.

YENI will process personal information in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as applicable.

This notice applies to personal information relating to people who interact with YENI, including young people and their parents/guardians, volunteers, staff and applicants, schools and educational contacts, business contacts, supporters, donors, alumni, event participants and website users.

The information we collect depends on the nature of our relationship with you and the services, programmes or activities involved. It may include:

• Name, age, school or organisation and contact details.
• Postal address, email address and telephone number.
• Information needed to register for, organise or participate in YENI programmes, events, competitions, awards and activities.
• Volunteer information, including experience/job role, availability and information required to support programme delivery.
• Information required for safeguarding, identity verification, background checks or other statutory checks where applicable.
• Donation, financial support and payment information, including limited bank or transaction information where needed.
• Feedback, survey responses, correspondence and records of communications with YENI.
• Photographs, video and other recordings where collected and used in accordance with this notice and any consent arrangements.
• Information required for accreditation or assessment on behalf of an awarding body.
• Information obtained from publicly available sources where appropriate.

YENI delivers programmes to children and young people. We recognise that children require particular protection when their personal information is processed and will take account of their age, understanding and best interests.

We seek to collect only the information that is necessary for programme participation, eligibility, administration, safeguarding, events, awards, communication and other clearly explained purposes.

Where consent is the appropriate lawful basis, YENI will use consent mechanisms that are clear and understandable. Where appropriate, YENI may seek the involvement or consent of a parent or guardian.

• Directly from you, for example when you register for a programme or event, volunteer, donate, provide feedback or contact us.
• From schools, colleges, centres, employers or other organisations involved in delivering or supporting YENI activities.
• From partner or independent organisations where information is shared lawfully and where appropriate, with consent.
• Through YENI's website, online forms, surveys, event systems and other digital services.
• From publicly available sources where this is lawful, fair and proportionate.

• To register and administer participation in programmes, events, competitions, awards and activities.
• To communicate with participants, parents/guardians, schools, volunteers, supporters and business contacts.
• To recruit, manage and support volunteers and staff.
• To meet safeguarding, legal, regulatory and contractual responsibilities.
• To verify identity or process statutory/background checks where necessary.
• To administer donations, fundraising and supporter relationships.
• To obtain feedback, evaluate programme impact and produce statistical or management information.
• To administer accreditation, assessment and reporting requirements.
• To improve our programmes, communications, services and website.
• To promote YENI's charitable activities, volunteering opportunities, events and fundraising where lawful.
• To establish, exercise or defend legal claims and protect YENI, its people, systems and property.

YENI will identify and document an appropriate lawful basis for each processing activity. Depending on the circumstances, these may include:

• Consent - where we ask you to make a genuine, informed and freely given choice.
• Contract - where processing is necessary to enter into or perform an agreement with you.
• Legal obligation - where processing is necessary for YENI to comply with a legal or regulatory requirement.
• Legitimate interests - where processing is necessary for YENI's legitimate interests or those of a third party.
• Vital interests - in exceptional circumstances where processing is necessary to protect someone's life or other vital interests.

Where consent is relied upon, individuals may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Photographs and video may be taken during programmes and activities to demonstrate the impact of YENI's work, recognise achievements, support communications and promote our charitable activities.

YENI will use appropriate arrangements with schools, centres and programme partners to identify individuals for whom the required permission or consent has not been obtained.

YENI may share personal information where this is necessary, lawful and proportionate. Depending on the circumstances, recipients may include:

• Schools, colleges, youth organisations or programme delivery partners involved in delivering YENI activities.
• Volunteers and programme participants where limited contact information is necessary.
• Service providers and data processors who provide systems or services to YENI.
• Funders, auditors or other organisations where reporting is required or otherwise lawful.
• Professional advisers, insurers, regulators, law enforcement or other authorities where required or permitted by law.

YENI does not sell personal information or share unnecessarily. YENI will not disclose personal information to third parties for their own independent marketing purposes.

YENI takes appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing, accidental loss, destruction or damage.

Access to personal information is limited to people who need it for their role. YENI will assess and respond to suspected personal data breaches in accordance with its internal data breach procedure and applicable legal requirements.

YENI will retain personal information only for as long as it is reasonably necessary for the purposes for which it was collected, including legal, accounting, safeguarding, regulatory, contractual and reporting requirements.

When information is no longer required, it will be securely deleted or anonymised where appropriate.

Subject to legal conditions and exemptions, individuals may have rights to:

• Be informed about how their personal information is used.
• Request access to personal information held about them.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for personal information to be erased in certain circumstances.
• Ask for processing to be restricted in certain circumstances.
• Object to certain processing, including processing based on legitimate interests and certain direct marketing.
• Receive personal information in a portable format where the right to data portability applies.
• Withdraw consent where processing is based on consent.
• Rights relating to automated decision-making and profiling where applicable.

Requests should be made using the contact details below. YENI will respond within the statutory timescales applicable to the request and may need to verify the identity of the requester.

YENI may communicate with supporters, volunteers, alumni and other contacts about events, volunteering, fundraising and opportunities to support our charitable aims where this is lawful.

Electronic marketing will comply with PECR and UK data protection requirements. Individuals will be given an appropriate opportunity to opt out of marketing communications and opt-out requests will be respected.

YENI's website may use cookies and similar technologies to operate the website, remember preferences, understand how the website is used and improve functionality.

Where consent is legally required for a cookie or similar storage/access technology, YENI will obtain consent before using it.

If you have concerns about how YENI has handled your personal information, you can make a data protection complaint using the contact details below.

YENI will provide a clear means of making a complaint, acknowledge the complaint within 30 days and investigate and communicate the outcome without undue delay.

Young Enterprise NI is the data controller.

If you have a question about this Privacy Notice, want to exercise a data protection right, or wish to make a data protection complaint, please mark it for the attention of the Data Protection Officer at info@yeni.co.uk.

If you are not satisfied with how YENI has handled your data protection complaint, you have the right to complain to the Information Commissioner's Office (ICO).

ICO website: ico.org.uk/concerns

ICO telephone: 0303 123 1113

YENI keeps this Privacy Notice under regular review and may update it to reflect changes in legislation, regulatory guidance, technology, services or the way we process personal information.

The latest version will be made available through the YENI website or other appropriate channels.

Young Enterprise Northern Ireland is registered with The Charity Commission for Northern Ireland NIC107515 and incorporated in Northern Ireland, no. NI32769.

YENI is registered with the Information Commissioner's Office (ICO) under registration reference ZA301655.

• UK General Data Protection Regulation (UK GDPR).
• Data Protection Act 2018.
• Data (Use and Access) Act 2025 (DUAA).
• Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.
• ICO guidance on privacy notices, individual rights, children's information, direct marketing, cookies and data protection complaints.