Privacy policy

PRIVACY POLICY

PurposeThis Privacy Policy describes how EduSpots (“we” or “us”) collects, processes and shares personal information about you, how we protect this information, and your rights in relation to this information.

This Privacy Policy applies to all personal information we collect or process about you acting as a data controller. Personal information is information, or a combination of pieces of information, that could directly or indirectly identify you.

We process personal information in accordance with all applicable data protection legislation in the countries where we operate, and in accordance with this Privacy Policy. All personal information is processed securely and used only as described here.

Our contact details

Organisation name: EduSpots

Charity number: 1166734

Registered address: Flat 3, 20 Atlingworth Street, Brighton, BN2 1PL.

Contact email: info@eduspots.org

Data Lead: Ffion Chambers, Global Head of Operations

For any questions or concerns relating to how we handle personal data, or to exercise your data protection rights, please contact our Data Lead in the first instance at support@eduspots.org

What information we collect, use, and why

Job applicants:

Contact details (e.g. name, address, telephone number or personal email address)
CV or other document listing your competence, education, work history and any other information provided in such document by you including any links to external sources of personal information, such as a LinkedIn profile
Names and contact information of references
Any other personal information voluntarily submitted by you during the application process

We collect information from job applicants so we can manage the recruitment process fairly and lawfully. This includes assessing your suitability for the role, verifying qualifications and right-to-work status, communicating with you throughout the process, making informed hiring decisions, preventing fraud, ensuring the security of our systems, and maintaining records needed for equal opportunities monitoring and business planning.

Employees & Contractors:

Contact details (e.g. name, address, telephone number or personal email address)
Date of birth
National Insurance number
Gender
Copies of passports or other photo ID
Copies of proof of address documents (e.g. bank statements or bills)
Next of kin or emergency contact details
Employment history (e.g. job application, employment references or secondary employment)
Education history (e.g. qualifications)
Right to work information
Performance records (e.g. reviews, disciplinary records, complaints or disciplinary action)
Training history and development needs
Job role and employment contract (e.g. start and leave dates, salary, changes to employment contract or working patterns)
Expense, overtime or other payments claimed
Leave (e.g. sick leave, holidays or special leave)
Maternity, paternity, shared parental and adoption leave and pay
Pension details
Bank account details
Payroll records
Tax status

We collect employee and contractor information so we can run our employment relationship properly and legally. This includes confirming your right to work, paying you, administering your contract and any applicable benefits, managing performance, supporting training and development, ensuring health, safety and security, handling disputes or disciplinary matters, protecting our systems, and carrying out essential business planning and analytics.

Funders:

Contact details (e.g. name, address, telephone number or personal email address)
Employer organisation
Donation history

We collect funder information to acknowledge support, for relationship management, to conduct due diligence, to maintain accurate financial records, and keep you updated on relevant activity.

Individual supporters:

Contact details (e.g. name, address, telephone number or personal email address)
Information about donations

We collect information from individual supporters to process and acknowledge donations, keep accurate records, to conduct due diligence and for relationship management.

EduSpots’ Programme Participants

Full name
Date of birth
Gender
Geographical location
Disability status
Programme attendance and engagement data (e.g. time spent, sessions attended)
Any other information recorded by an authorised Spot Lead or Catalyst during programme delivery

We collect this information to monitor and evaluate the impact of our programmes, to ensure appropriate support is provided to learners, and to report to funders and stakeholders on programme outcomes. All data relating to programme participants is collected with the prior written consent of a parent or guardian. Participants and their parents or guardians may request access to, correction of, or deletion of their data at any time using the contact details at the top of this policy.

EduSpots Catalysts [community personnel]

Name and contact information
Age bracket
Emergency contact name and contact information
Geographical location
Programme engagement and activity data
Profession
Police checks
App usage data
Monthly educational challenge uploads

Catalysts are volunteer community members who sit at the heart of EduSpots’ programme delivery. They lead educational sessions, engage directly with learners, and are responsible for recording and logging programme activity through the EduSpots app. We collect information from Catalysts to support their involvement in our programmes, monitor engagement and activity, and evaluate the impact of our work. Catalysts are authorised by EduSpots before being granted access to the app, and the data they record is handled in accordance with this policy.

Users of the website and marketing contacts:

Contact details (e.g. name, address, telephone number or personal email address)
Employer organisation and your role in the organisation
IP address
Other personal information submitted by you

We collect information from website users and marketing contacts to communicate with you, understand how our site is used, and respond to enquiries.

Additionally, we may collect information from you using cookies and other device identifying technologies. Please see information on Cookies below to learn more and to manage your consent choices.

Our website uses cookies to help it function correctly. We use only essential cookies, which are necessary for the website to operate and cannot be switched off. These cookies do not collect any personally identifiable information and are not used for marketing or tracking purposes.

Where we use any non-essential cookies (for example, to understand how visitors use our site), we will ask for your consent before placing them on your device. You can withdraw your consent or manage your cookie preferences at any time by adjusting your browser settings. Please note that disabling cookies may affect the functionality of certain parts of the website.

If you have any questions about how we use cookies, please contact us at info@eduspots.org.

Our lawful bases for the collection and use of your information

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights which are listed under section ‘Your rights over your personal information’ of this Policy. Although this section refers to UK law, equivalent lawful bases apply under the Ghana Data Protection Act 2012 and the Kenya Data Protection Act 2019 where those laws apply to you.

Our lawful bases for collecting or using job applicants personal information are:

Legitimate interest – to evaluate your suitability for the position(s) you have applied for and to defend against potential legal claims for discrimination.
Contract – we have to collect or use the information so we can prepare to enter into a contract with you.

Our lawful bases for collecting or using employee and contractors personal information are:

Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
Legal obligation – we have to collect or use your information so we can comply with the law.
Special category data – where we process special category data about employees and contractors (for example, health information arising from sickness absence, or maternity, paternity and related leave), we do so as necessary for carrying out our obligations and exercising our rights in the field of employment law.

Our lawful bases for collecting or using funders personal information are:

Legitimate interests – to collect and process donations, to manage communications and administration of donor management.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
Legal obligation – we have to collect or use your information so we can comply with the law.

Our lawful bases for collection or using individual supporters personal information are:

Legitimate interests – to manage communications and administration of donor management.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
Legal obligation – we have to collect or use your information so we can comply with the law.

Our lawful bases for collecting or using EduSpots Programme Participant personal information are:

Consent – we collect and process personal information about programme participants on the basis of consent provided by a parent or guardian prior to any data being recorded. Where a participant is of sufficient age and maturity to provide their own consent, we will seek this directly in addition to parental consent. This information is gathered by Catalysts on behalf of EduSpots.
Special category data – some of the information we process about programme participants, in particular disability status, is special category data under UK GDPR (and special or sensitive personal data under Ghanaian and Kenyan law), which requires a further condition for processing. We process this on the basis of the explicit consent given by a parent or guardian (and, where appropriate, by the participant), and only to provide appropriate support to learners and to monitor and evaluate the impact of our programmes.

Our lawful bases for collecting or using app user (Catalyst or Spot Lead) personal information are:

Contract – we collect and use this information to carry out our agreement with Spot Leads and Catalysts to deliver EduSpots programmes.
Legitimate interests – to monitor programme engagement, evaluate impact, and ensure the effective delivery of our programmes.

Our lawful bases for collection or using the personal information of users of the website and marketing contacts are:

Legitimate interests – for basic supporter management, communications, registration of events and responding to requests
Consent – where consent is required for marketing activities

Children’s Data

EduSpots works with children and young people as part of its core programme delivery. Through our app, authorised community personnel record personal data relating to EduSpots programme participants who may be under the age of 18. We take our responsibilities in relation to children’s data extremely seriously.

The following safeguards are in place:

Parental or guardian consent is always obtained by Catalysts before any personal data relating to a child is recorded in the app.
Personal data relating to programme participants is only accessible to the community personnel assigned to that programme and location and to senior EduSpots staff.
Community personnel cannot access personal data relating to participants in other communities or programmes.
Data relating to children is retained only for as long as is necessary for programme evaluation and reporting purposes, after which it is securely deleted. See our retention section for further detail.
Any data breach involving children’s personal data will be treated as a priority and reported to the relevant authorities in accordance with our legal obligations.

App Access and Data Controls

EduSpots operates a mobile application used by authorised community personnel to record and manage EduSpots’ programme participant data. The following access controls are in place to ensure security of the data captured:

EduSpots staff monitor and verify applications for community personnel to open an account on the EduSpots app. Access will be revoked upon the conclusion of a community personnel’s involvement with EduSpots programmes.
Community personnel can only view and record data for the community or programme to which they have been assigned and approved by EduSpots.
Community personnel cannot view personal data (including names, dates of birth or gender) belonging to participants in other communities or programmes.
Aggregated or anonymised activity data (such as programme engagement levels) may be visible across communities for reporting purposes but will never include personally identifiable information.
Access to the full dataset is restricted to senior EduSpots staff only.

Where we collect your information

The personal information we collect is primarily collected directly from you. We may on occasion collect ‘Know Your Donor’ due diligence information about you from publicly available sources.

Your rights over your personal information

EduSpots is committed to upholding your data protection rights regardless of where you are based. Depending on your location, your rights are protected under UK GDPR, the Ghana Data Protection Act 2012, or the Kenya Data Protection Act 2019. Whilst the specific rights available to you may vary slightly depending on your jurisdiction, we are committed to honouring the following rights for all individuals whose data we process:

Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure – You have the right to ask us to delete your personal information.
Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
Your right to object to processing – You have the right to object to the processing of your personal information.
Your right to information portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.

To make a data protection rights request, please contact us using the contact details at the top of this Privacy Policy. If you make a request, we will respond without undue delay and in any event within one month.

If you are based in Ghana and feel your rights have not been upheld, you may contact the Data Protection Commission of Ghana. If you are based in Kenya, you may contact the Office of the Data Protection Commissioner. If you are based in the UK, you may contact the Information Commissioner’s Office.

We encourage you to contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate. We will contact you if we need additional information from you in order to process your request.

How long we keep your information for

We only process personal information for as long as is necessary to fulfil the purpose for which it was collected and/or where we have a legal basis for continuing to do so. Our retention periods for different categories of data are as follows:

Programme participant data (including data relating to children): retained for 7 years following the end of a participant’s involvement in an EduSpots programme, after which it is securely deleted. This is kept for evaluation purposes.
App user (community personnel) data: retained for 7 years following the end of a Catalyst’s involvement with EduSpots, after which it is securely deleted. This is also kept for evaluation purposes.
Employee and contractor data: retained for 6 years following the end of employment or contract, in line with the statutory limitation period for employment-related legal claims.
Funder and supporter data: retained for 7 years for audit, Gift Aid and relationship management purposes, in line with HMRC requirements.
Job applicant data: retained for 3 years from the date of application so we can contact applicants about future opportunities, on the basis of our legitimate interest in recruitment, after which it is securely deleted. Applicants may opt out and request deletion of their information at any time.

Reasons we may continue to hold your information beyond these periods include to:

Maintain donation records for analysis and/or audit purposes
Comply with record retention requirements under the law
Defend or bring any existing or potential legal claims
Deal with any complaints

We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the information.

If you hold an account on the EduSpots app, you can ask us to delete your account and the personal data associated with it at any time. To request deletion, email us at support@eduspots.org We will action your request without undue delay and in any event within one month and will confirm once it has been completed.

When you delete your account, we will delete the personal data we hold about you, except where we are required or permitted to retain certain information for legitimate reasons – including legal or regulatory compliance, financial and audit records, the defence of legal claims, and the monitoring and evaluation of our programmes. In particular, programme delivery records created by Catalysts during their role (such as session and engagement data relating to learners) belong to EduSpots and are retained in line with the retention periods set out above, even after an individual Catalyst’s account has been deleted. Any data we retain is held securely and only for as long as necessary.

If any information cannot, for technical reasons, be fully deleted from our systems, we will put appropriate measures in place to prevent any further processing or use of that information.

Information Sharing

We may share your personal information with third parties under the following circumstances:

Service providers and business partners. We may share your personal information with our service providers and business partners that perform marketing services and other business operations for us.
Social media. With your consent, we may publish your details (including name, photo, quotes, etc) on our social media accounts, but we will never share your contact details or other personal information.
Law enforcement agency, court, regulator, government authority or other third party. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

The recipients referred to above may be located outside the UK. See the section on “International data Transfer” below for more information.

We will only share or exchange information with third parties with the protection of a written agreement and the ability to oversee their activities, unless information is required for legal or regulatory reasons.

Where we have relationships with other organisations that process your information on our behalf, we take care to ensure they have high information security standards. We will not allow these organisations to use your personal information for unauthorised purposes.

Data Controllers and Processors

EduSpots as Data Controller: EduSpots is the data controller for all personal data collected through our programmes and app. This means we are legally responsible for determining how personal data is collected, used and protected, and we are accountable to the relevant data protection authorities.

Catalysts and Staff as Data Processors: Our Catalysts and staff act as data processors on EduSpots’ behalf. When a Catalyst or staff member logs activity or records participant information through the EduSpots app, they do so in accordance with EduSpots’ data handling guidelines and within the scope of their role in delivering our programmes. Neither Catalysts nor staff are permitted to use programme participant data for any purpose other than the delivery and monitoring of EduSpots programmes.

Authorisation and Accountability: All Catalysts must be authorised by EduSpots before being granted access to the app. Staff access is granted as part of their role at EduSpots, and the level of access they are granted is dependent on their role function. By using the app, both Catalysts and staff agree to handle personal data in accordance with this policy. EduSpots remains fully responsible for ensuring that all data processed through the app is handled lawfully and securely, regardless of who has recorded it.

Information security & storage

We follow generally accepted standards to protect the personal information submitted to us, both during transmission and once it is received. Depending on the nature of your relationship with us, and what we hold your information for, we may use third party applications to store and process your information, for example Google Drive.

Our app is subject to specific technical security controls, including role-based access restrictions, secure login requirements, and limitations on data visibility between users. Personal data recorded through the app is stored on servers located in the EU. Where data is stored or processed outside the UK, appropriate safeguards are in place as described in the International Data Transfer section below.

Protection of personal information and information security is of utmost importance to us. All personal information is handled with a high level of security and confidentiality. Personal information can only be accessed by individuals who require such access while performing their tasks or duties. All personal information is stored and reliably secured using appropriate technical and organisational measures. All service providers involved in processing personal information have signed appropriate information protection agreements and other relevant documents with us.

International data transfer

Your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information under UK data protection law (including adequacy regulations).

Where this is the case, we take all reasonably necessary steps to ensure that your information is treated securely, in accordance with this Privacy Policy and the requirements of applicable law. Such measures may include, as applicable, entering into data processing agreements, standard contractual clauses or International Data Transfer Agreements and monitoring such protections to ensure the continued adequacy of such measures.

Jurisdiction

EduSpots is a UK-registered charity and processes personal data in accordance with UK GDPR and applicable UK data protection law. However, as we operate programmes in Ghana and Kenya, we also recognise our obligations under the data protection legislation of both countries – the Data Protection Act 2012 (Ghana) and the Data Protection Act 2019 (Kenya). Where personal data is collected from individuals based in either country, we take all reasonable steps to ensure compliance with both UK and local legal requirements. In the event of any conflict between jurisdictions, we will seek appropriate legal advice to ensure the rights of individuals are protected.

Complaints

If you have questions or concerns regarding the way in which your personal information has been used, please contact us using the contact details at the start of this Policy. We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If you believe that we have not been able to assist with your complaint or concern, you have the right to escalate to the relevant data protection authority in your country. If you are based in the UK, this is the Information Commissioner’s Office. If you are based in Ghana, this is the Data Protection Commission of Ghana. If you are based in Kenya, this is the Office of the Data Protection Commissioner. Please see contact information below for each relevant data protection authority:

United Kingdom — Information Commissioner’s Office (ICO)
Website: https://ico.org.uk

Ghana — Data Protection Commission (DPC)
Email: info@dataprotection.org.gh – Website: https://www.dataprotection.org.gh

Kenya — Office of the Data Protection Commissioner (ODPC)
Email: info@odpc.go.ke – Website: https://www.odpc.go.ke

Changes to the Policy

You may request a copy of this Privacy Policy from us using the contact details set out at the start of this Policy. We may modify or update this Privacy Policy from time to time.

Where changes to this Privacy Policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).

Review and amendments

We are committed to reviewing this Policy annually in line with current legislation & best practice guidance, or sooner in light of any changes in legislation or guidance.

This Policy came into force on:

1st July 2018

The Policy and any accompanying procedures were last reviewed on:

28th June 2026

Signed:

Name: Cat Davison

Position: CEO