Data protection policy

Biliki collects and uses personal information as part of its work with young people, participants, parents and carers, staff, volunteers, mentors, facilitators, partners and other stakeholders.

Biliki is committed to handling personal data lawfully, fairly, transparently and securely.

This policy sets out the principles and responsibilities that apply to personal data processed by or on behalf of Biliki.

It should be read alongside Biliki's privacy notices, information security arrangements and other relevant policies.

This policy applies to everyone who processes personal data on behalf of Biliki, including:

• employees;
• contractors;
• facilitators;
• mentors;
• volunteers;
• programme staff;
• Advisory Board members where relevant to their role;
• consultants and advisers; and
• third-party organisations processing data on Biliki's behalf.

It applies to personal data held in:

• electronic systems;
• email;
• shared drives;
• online platforms;
• paper records;
• forms;
• programme records;
• photographs and video;
• safeguarding records; and
• other information systems used by Biliki.

Biliki will appoint a Data Protection Lead.

The Data Protection Lead is responsible for overseeing Biliki's data protection arrangements and supporting compliance with applicable data protection law.

Responsibilities include:

• maintaining this policy;
• supporting privacy notices and data protection procedures;
• advising on data protection risks;
• supporting the management of data breaches;
• coordinating responses to data subject requests;
• supporting staff and volunteer training;
• maintaining appropriate data protection records;
• advising on data sharing and third-party processors; and
• identifying when specialist advice is required.

The Data Protection Lead may delegate operational tasks but remains responsible for coordinating Biliki's data protection framework.

Personal data

Information relating to an identified or identifiable living individual.

Examples include:

• names;
• contact details;
• addresses;
• identification information;
• participant records;
• employment information; and
• online identifiers.

Special category data

Certain types of personal data receive additional protection under UK data protection law.

Examples include information relating to:

• health;
• racial or ethnic origin;
• religion;
• political opinions;
• trade union membership;
• genetics;
• biometrics used for identification;
• sex life; and
• sexual orientation.

Processing

Any operation carried out on personal data, including collecting, recording, storing, using, sharing or deleting it.

Data controller

The organisation that determines why and how personal data is processed.

Data processor

An organisation or individual that processes personal data on behalf of a controller.

Data subject

The individual to whom personal data relates.

Biliki will apply the following principles.

Lawfulness, fairness and transparency

Biliki will process personal data lawfully and fairly and will explain clearly how and why it is used.

Purpose limitation

Biliki will collect and use data for specified, explicit and legitimate purposes.

Data minimisation

Biliki will collect only the information that is necessary for the relevant purpose.

Accuracy

Biliki will take reasonable steps to ensure personal data is accurate and kept up to date where necessary.

Storage limitation

Biliki will not keep personal data for longer than necessary.

Security

Biliki will use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure.

Accountability

Biliki will maintain appropriate records and controls to demonstrate that it takes its data protection responsibilities seriously.

Biliki will identify an appropriate lawful basis before processing personal data.

Depending on the circumstances, this may include:

• consent;
• performance of a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a task carried out in the public interest or in the exercise of official authority, where applicable; or
• legitimate interests, where applicable and appropriate.

Where special category data is processed, Biliki will also identify an appropriate additional condition required by law.

Consent will not be treated as the default lawful basis for all processing.

Biliki will provide clear and accessible privacy information when collecting personal data.

Privacy notices should explain, as appropriate:

• what information Biliki collects;
• why it is collected;
• the lawful basis for processing;
• how the information is used;
• who it may be shared with;
• how long it is retained;
• individual rights; and
• how to contact Biliki about data protection.

Where Biliki works with children and young people, privacy information will be presented in a way that is understandable and appropriate to their age and circumstances.

Biliki recognises that children and young people require particular care when their personal data is processed.

Biliki will:

• use age-appropriate privacy information where appropriate;
• collect only information that is necessary;
• apply appropriate security controls;
• consider the best interests and reasonable expectations of young people;
• take particular care with photographs, video and other public-facing information; and
• apply additional safeguards where the nature of the processing creates higher risks.

Biliki will determine the appropriate approach to consent, parental involvement and other lawful bases according to the specific processing activity and applicable law.

Biliki may need to process special category data in limited circumstances, including where relevant to participant support, accessibility, safeguarding or programme delivery.

Such information must only be collected where there is a clear and lawful reason to do so.

Access should be limited to people who need the information for their role.

Staff and volunteers must not collect sensitive information simply because it may be useful in the future.

Biliki will take proportionate steps to protect personal data.

This may include:

• password-protected systems;
• multi-factor authentication where available and appropriate;
• access controls;
• secure storage;
• appropriate device security;
• controlled access to shared folders;
• secure disposal;
• appropriate backups;
• staff awareness and training; and
• controls over third-party systems.

People working with Biliki must:

• keep passwords confidential;
• not share accounts;
• use approved systems where required;
• avoid storing participant information unnecessarily on personal devices;
• take care when sending information by email;
• check recipients before sending personal data; and
• report suspected breaches promptly.

A personal data breach may include:

• loss of a device containing personal data;
• sending information to the wrong person;
• unauthorised access;
• accidental disclosure;
• hacking or cyberattack;
• loss or destruction of data; or
• inappropriate access to records.

Anyone who becomes aware of a suspected breach must report it promptly to the Data Protection Lead.

Biliki will assess the breach, contain it where possible, record the relevant facts and determine whether notification to the Information Commissioner's Office or affected individuals is required.

Where a breach is notifiable to the ICO, the applicable legal deadline will be followed.

Biliki recognises the rights individuals may have under UK data protection law, including rights relating to:

• being informed;
• access to personal data;
• rectification;
• erasure;
• restriction of processing;
• data portability; and
• objection.

These rights are not absolute and depend on the circumstances and applicable legal requirements.

A Subject Access Request (SAR) is a request by an individual to access their personal data.

Requests should be sent to the Data Protection Lead.

Biliki will:

• identify and log the request;
• verify identity where appropriate;
• identify relevant personal data;
• assess whether any exemptions or restrictions apply;
• provide the appropriate information securely; and
• respond within the applicable legal timeframe.

The standard response period for a SAR is normally one month, subject to the circumstances and applicable rules.

Biliki will share personal data only where there is a lawful basis and the sharing is necessary and proportionate.

This may include sharing information with:

• schools;
• parents or carers where appropriate;
• delivery partners;
• professional advisers;
• service providers;
• safeguarding professionals;
• emergency services;
• statutory authorities; or
• other organisations where there is a lawful and appropriate reason.

Safeguarding considerations may require information to be shared to protect someone from harm.

Data protection law should not be treated as an automatic barrier to necessary safeguarding information sharing.

Biliki may use third parties to process personal data, including providers of:

• email;
• cloud storage;
• CRM systems;
• payroll;
• event management;
• programme management;
• communications; and
• other digital services.

Where a third party acts as a processor for Biliki, Biliki will take appropriate steps to ensure that:

• the processor is appropriately assessed;
• contractual requirements are in place where required;
• the processor acts only on appropriate instructions;
• personal data is protected;
• security arrangements are appropriate; and
• data is not used for unrelated purposes.

Biliki will maintain appropriate records of its personal data processing activities.

The level of detail will be proportionate to Biliki's size and activities but should enable Biliki to understand:

• what personal data it processes;
• why it processes it;
• its lawful basis;
• who receives it;
• where it is stored;
• how long it is retained; and
• relevant risks and safeguards.

Biliki will retain personal data only for as long as there is a legitimate and documented reason to do so.

Retention periods will reflect:

• legal requirements;
• contractual requirements;
• operational needs;
• safeguarding considerations;
• financial and accounting requirements;
• the purpose for which the information was collected; and
• the potential impact of retaining the information.

Biliki will maintain a separate retention schedule setting out specific retention periods for different categories of records.

The default position should not be to retain personal data indefinitely.

Photographs and video may contain personal data and must be handled appropriately.

Biliki will:

• identify the purpose for which images are collected;
• provide appropriate information;
• obtain appropriate permissions or identify another lawful basis where required;
• take particular care when photographing children and young people;
• avoid unnecessary identification of participants;
• store images securely;
• limit access where appropriate; and
• delete or archive images in accordance with the relevant retention arrangements.

Detailed requirements are set out in Biliki's Photography, Filming and Image Use Policy.

Recording devices, including mobile phones, wearable devices, audio recorders and tools capable of creating transcripts, must only be used in accordance with Biliki's policies and applicable data protection requirements.

People must not make recordings of participants for personal purposes.

Where artificial intelligence tools are used to process personal data, Biliki will consider:

• what data is being entered;
• why it is being processed;
• the lawful basis;
• where the data is stored;
• whether the provider uses the data for other purposes;
• security;
• retention;
• confidentiality;
• risks to individuals; and
• whether a Data Protection Impact Assessment is required.

Personal or safeguarding information must not be entered into an AI tool unless its use has been appropriately authorised.

Where Biliki sends marketing or promotional communications electronically, it will comply with applicable data protection and electronic communications requirements.

People will be given appropriate information and choices about communications.

Biliki will maintain appropriate records of communication preferences and opt-outs.

Where personal data is transferred outside the UK, Biliki will ensure that the transfer is lawful and that appropriate safeguards are in place.

Biliki will consider the location and terms of third-party digital services as part of its supplier and data protection assessment.

Personal data must only be accessed and used by people who have a legitimate reason to do so.

Confidentiality requirements apply during and after a person's involvement with Biliki.

Confidential information must not be disclosed through:

• personal social media;
• informal messaging;
• public conversations;
• personal email accounts; or
• other unauthorised channels.

Everyone working with Biliki must understand the data protection responsibilities relevant to their role.

Biliki will provide appropriate information or training.

Individuals must:

• follow this policy;
• follow relevant procedures;
• protect personal information;
• use approved systems appropriately;
• report suspected breaches;
• avoid unnecessary collection or sharing; and
• ask for advice where they are unsure.

Biliki will consider whether a Data Protection Impact Assessment (DPIA) is required before starting processing that is likely to create a high risk to individuals.

A DPIA may be particularly relevant where Biliki proposes:

• large-scale processing of sensitive information;
• new technology;
• systematic monitoring;
• extensive processing involving children;
• new forms of profiling; or
• other processing that could create significant risks.

Anyone who has concerns about Biliki's handling of their personal data should contact the Data Protection Lead in the first instance.

Biliki will investigate complaints fairly and seek to resolve them appropriately.

Individuals may also have the right to complain directly to the Information Commissioner's Office.

This policy should be read alongside:

• Safeguarding Policy;
• Code of Conduct;
• Photography, Filming and Image Use Policy;
• Online Safety and Digital Communications Policy;
• Information Security arrangements;
• Records Retention Schedule;
• Complaints Policy; and
• relevant programme-specific procedures.

Biliki will keep this policy under review against applicable UK data protection law and current guidance from the Information Commissioner's Office.