1. Who We Are

Impact Transition Services CIC (referred to in this policy as "ITS," "we," "us," or "our") is a Community Interest Company registered in England and Wales. We are a social impact organisation working to support young people in safely transitioning back into their communities through structured programmes, safeguarding-led services, and multi-agency partnerships.

Registered Name: Impact Transition Services CIC Registered in: England and Wales Contact Email: info@impacttransitionservices.org.uk Website: impacttransitionservices.org.uk

We are committed to protecting your personal data and handling it responsibly, transparently, and in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

2. What This Policy Covers
This Privacy Policy explains:
 

• What personal data we collect

• Why we collect it and how we use it

• Who we share it with

• How long we keep it

• Your rights regarding your data

• How to contact us or raise a concern
   

This policy applies to all data collected through our website, services, referral processes, partnerships, and communications.

 

3. The Data We Collect

Depending on how you interact with us, we may collect the following types of personal data:
 

Contact and Identity Data

• Name, title, email address, phone number, and postal address

Professional and Organisational Data

• Job title, organisation name, and professional role (for partner agencies and referrers)
   

Service User Data

• Age, gender, and relevant background information necessary to assess and deliver appropriate support

• Referral information provided by agencies, schools, probation services, or local authorities

• Case notes, progress records, and programme participation data
   

Website Usage Data

• IP address, browser type, pages visited, and time spent on our website (collected via cookies and analytics tools)
   

Communications Data

• Records of emails, enquiries, or correspondence you send to us
   

Sensitive Personal Data Where relevant to the delivery of our services, we may collect special category data including:

• Criminal history or offending background (for programme eligibility and safeguarding purposes)

• Health or vulnerability information (where shared by referrers or service users to inform safe support)
   

We only collect sensitive data where there is a clear lawful basis and a legitimate
safeguarding or service delivery need to do so.

 

4. How We Collect Your Data

        We collect personal data through:

• Direct contact via email, telephone, or our website contact form

• Referrals submitted by partner agencies, schools, probation services, or local authorities

• Programme registration and onboarding processes

• Cookies and analytics tools when you visit our website

Meetings, events, and partnership discussions

​
 

5. Our Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. Depending on the context, we rely on the following:
 
Purpose

• Delivering support services to young people ​

• Safeguarding and risk management

• Processing referrals from partner agencies

• Communicating with stakeholders and partners

• ​Website analytics and performance

• Sending updates or newsletters

• ​Responding to enquiries

• 
   

Lawful Basis​

• Legitimate interests / Public task​

• Legitimate interests / Legal obligation

• Legal obligation / Vital interests

• Legitimate interests

• ​Legitimate interests (with consent for cookies)

• Consent

• ​Legitimate interests

Where we process special category data (such as criminal history or health information), we rely on:
 

• Substantial public interest — for safeguarding and social care purposes

• Vital interests — where necessary to protect the safety of an individual

• Explicit consent — where obtained directly from the individual

6. How We Use Your Data

• We use the personal data we collect to:

• Assess and process referrals for our programmes

• Deliver safe, structured transition and reintegration support

• Maintain safeguarding records and risk management frameworks

• Communicate with partner agencies, referrers, and stakeholders

• Build and manage multi-agency relationships

• Apply for and report on grants and funded contracts

• Monitor and evaluate programme outcomes

• Improve our website and communications

• Meet our legal and regulatory obligations
   

We do not use your data for automated decision-making or profiling.

 

7. Who We Share Your Data With

We will only share your personal data where necessary and appropriate. This may include:
 

Partner Agencies and Statutory Bodies Where required for safeguarding, referral coordination, or multi-agency working — including probation services, youth offending teams, local authorities, schools, PRUs, and social care.
 

Funders and Commissioners Anonymised or aggregated data may be shared with grant funders or commissioners for reporting and accountability purposes. Personally identifiable data is only shared where explicitly required and permitted.
 

Our Service Providers We may use trusted third-party providers for services such as email, data storage, or website hosting. All providers are required to handle data securely and in line with UK GDPR.
 

Legal and Regulatory Authorities Where we are required by law to disclose data — including in safeguarding situations where there is a risk of serious harm to an individual or others.
 

We do not sell, rent, or trade personal data to any third party for commercial purposes.

 

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

Data Type

• Service user records

• Safeguarding records

• Partner and referrer contact data

• Website enquiries and emails

• Website analytics dat

Retention Period

• 7 years from last contact, or until age 25 for young people (whichever is longer)

• Minimum 10 years, or as directed by statutory guidance

• Duration of partnership + 3 years

• 2 years

• 3 months

After the relevant retention period, data is securely deleted or anonymised.

​

9. Data Security

We take the security of your personal data seriously. We have put in place appropriate technical and organisational measures to protect against unauthorised access, accidental loss, disclosure, or destruction. These include:
 

• Restricted access to personal data on a need-to-know basis

• Secure password-protected systems and file storage

• Encrypted communications where appropriate

• Regular review of our data handling practices

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform affected individuals where required.

 

10. Cookies

Our website uses cookies to help us understand how visitors use the site and to improve your experience.
 

Essential cookies are required for the website to function and cannot be switched off.
 

Analytics cookies help us understand website traffic and usage patterns. These are only placed with your consent.
 

You can manage your cookie preferences through the cookie banner on our website or by adjusting your browser settings. For more information about cookies generally, visit www.allaboutcookies.org.

 

11. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you

• Right to rectification — to request correction of inaccurate or incomplete data

• Right to erasure — to request deletion of your data in certain circumstances

• Right to restriction — to request that we limit how we use your data

• Right to data portability — to receive your data in a structured, machine-readable format

• Right to object — to object to our processing of your data based on legitimate interests

• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
  
   

• To exercise any of these rights, please contact us at: [info@impacttransitionservices.org.uk]

• We will respond to all requests within one calendar month. In some cases — particularly where we process data for safeguarding or legal purposes — we may be unable to delete or restrict data, and we will explain this to you clearly.
  
  
  12. Children and Young People

• Much of our work involves young people under the age of 18. Where we collect or process data relating to children, we do so with particular care and in line with our safeguarding obligations.

• We do not collect data directly from children via our website. All data relating to young people in our programmes is received through referral agencies, parents, carers, or legal guardians, and processed in accordance with our Safeguarding Policy and applicable statutory guidance.
  
  
  13. Third-Party Websites

Our website may contain links to external websites operated by partner organisations or third parties. This Privacy Policy applies only to our website. We are not responsible for the privacy practices of any external sites and encourage you to review their policies before sharing any personal data.


15. How to Contact Us or Raise a Concern
If you have any questions about this Privacy Policy, how we handle your data, or wish to exercise your rights, please contact us at: Portland Street, Fifth Floor, London, United Kingdom, W1W 5PF.

​
If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
 

Website: www.ico.org.uk

Helpline: 0303 123 1113

Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

​
 

This Privacy Policy was written in plain English to ensure it is accessible to all users of our services, including young people, families, and community partners.

Impact Transition Services CIC — Building safe transitions. Creating lasting change.