Privacy Policy

Last updated: March 2026

The Outside Club CIO ("we", "us", "our") is a Charitable Incorporated Organisation registered in England and Wales (charity number 1217018). We are committed to protecting the privacy of everyone who interacts with our services and our website.

This policy explains what information we collect, why we collect it, and how we use it. It covers the website at theoutsideclub.co.uk and the digital tools we use to run our sessions.

Who is responsible for your data

The Outside Club CIO is the data controller. Our website and digital platform are built and maintained by Beaufort Intelligence Ltd, who acts as our data processor under a signed Data Processing Agreement.

Beaufort Intelligence Ltd is registered with the Information Commissioner's Office (ICO reference: C1894329) and holds Professional Indemnity and Cyber Liability insurance through Hiscox (policy 15615722).

What information we collect

Contact form: If you use the contact form on our website, we collect your name, email address, and your message. We use this only to respond to your enquiry. We do not add you to any mailing list.

Donations: If you make a donation, your payment is processed securely by Stripe. We do not see or store your card details. Stripe may collect your name, email address, and payment information in accordance with their own privacy policy (stripe.com/privacy). We receive confirmation of your donation amount and email address so we can acknowledge your gift and, for monthly donors, manage your subscription.

Session logging: When we run youth sessions, our staff record basic operational data: the date, location, number of young people who attended, age brackets, activities, and brief observational notes about the session. This data is aggregate and does not identify individual young people. No names, addresses, photos, or other personal identifiers are recorded.

Feedback: We collect anonymous feedback from young people after sessions. This feedback contains no personal information: just an emoji mood rating and optional free-text comments. There is no way to link feedback responses to individual young people.

Website analytics: We do not use cookies for tracking or analytics. We do not use Google Analytics or any similar service. The only cookie our website sets is a session cookie for our content management system, which is used solely by our staff to update the website.

How we use your information

We use the information described above to:

- Respond to contact form enquiries - Process and acknowledge donations - Monitor the quality and reach of our sessions - Produce anonymised impact reports for funders and trustees - Improve our services

We will never sell your information to anyone. We will never share your information with third parties for marketing purposes.

Where your data is stored

Our website and platform are hosted on Amazon Web Services (AWS) in the EU (Stockholm, Sweden, eu-north-1 region). Contact form submissions, session logs, and feedback data are stored in encrypted S3 buckets. Donation data is held by Stripe under their own security and privacy policies.

How long we keep your data

Contact form messages: Deleted after 12 months.

Donation records: Retained for 7 years in line with UK financial record-keeping requirements. This is managed by Stripe.

Session logs: Retained for 13 months from the session date, then automatically deleted. Before deletion, anonymised aggregate statistics (total sessions, total attendees, activity counts) are preserved permanently for long-term impact reporting. These aggregate statistics contain no personal information.

Feedback: Retained for 13 months, then automatically deleted. Aggregate mood statistics are preserved permanently. These contain no personal information.

Your rights

Under UK data protection law (UK GDPR), you have the right to:

- Ask what personal data we hold about you - Ask us to correct inaccurate data - Ask us to delete your data - Object to how we use your data - Request a copy of your data in a portable format

Because our session logs and feedback are anonymous and contain no personal identifiers, these rights do not apply to that data (we could not identify which records are yours, because we do not collect that information).

For any data protection requests, or if you have questions about this policy, please visit our Contact Us page.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will always reflect the most recent version. Significant changes will be noted on our website.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to resolve the issue. If you remain unsatisfied, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.