Privacy Policy
This policy explains how Re-Invented Limited, trading as Reinvented, collects, uses and protects personal data when you visit our website, take part in a Reinvented or DigiSafe programme, or otherwise get in touch with us.
Who We Are
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller for personal data collected through this website and through any Reinvented programme is:
Re-Invented Limited, trading as Reinvented, a private company limited by guarantee registered in England and Wales, company number 17452414, registered office 60 Firs Lane, Leigh, WN7 4SB.
Questions about this policy or how we handle personal data can be sent to hello@re-invented.org
What Personal Data We Collect, and Why
What Personal Data We Collect, and Why :
- Contact form details (name, email, phone, message)
- Programme or event applications (name, contact details, eligibility information)
Mentor applications and references
DigiSafe participant data, including under-18s
Newsletter sign-up (email address)
Website usage data (cookies, analytics)
Safeguarding concern records
Why we collect it:
- To respond to your enquiry
- To assess eligibility, deliver the programme and report outcomes to funders and commissioners.
To assess suitability and manage mentor involvement, including safer recruitment checks
To deliver sessions safely and report anonymised outcomes to funders
To send updates about our work
To understand how the site is used and to improve it.
To protect children, young people and adults at risk, in line with our Safeguarding Policy.
Legal basis
- Legitimate interests (responding to enquiries)
Contract, legitimate interests, and consent where relevant.
Legitimate interests and legal obligation (safeguarding)
Consent (parental/guardian where required), legitimate interests, and legal obligation (safeguarding)
- Consent
Consent for non-essential cookies; legitimate interests for essential ones
Legal obligation and substantial public interest in safeguarding
Note: We only ask for the personal data we need for the purpose in question, and we never ask for more than that.
Children's Data
DigiSafe, and some of our other activity, involves children and young people under 18. We collect no more personal data from them than we need to deliver a session safely and report on outcomes.
Where a participant is under 13, we ask a parent or guardian (or, for school-linked delivery, the school acting on their behalf) to provide consent before we collect personal data directly from them. Young people aged 13 or over can generally consent for themselves under UK data protection law, but we still encourage parental or guardian involvement wherever practical.
If a safeguarding concern arises about a child or young person, we handle and share that information under our Safeguarding Policy, which takes priority over routine data-handling practices described elsewhere in this policy, because protecting a child’s safety comes first.
Who We Share Personal Data With
We share personal data only where it is needed, and never sell it. The main people and organisations we share it with are:
- Funders and commissioners, who receive anonymised or aggregated outcome data as part of our reporting obligations, not identifiable personal data, unless a funder’s own terms require a named case study and the individual has agreed to that.
- Service providers who process data on our behalf, such as [email and newsletter platform], [booking and CRM software] and [accounting software], each under a data processing agreement that requires them to protect it.
- Schools and partner venues, where delivery happens on their premises, limited to what they need to host the session safely.
- Statutory agencies, including local authority children’s and adult social care, the police, and the Local Authority Designated Officer, where we have a safeguarding or legal duty to share information, as set out in our Safeguarding Policy.
- Professional advisers, such as our accountant or legal adviser, where needed to run the organisation.
We do not transfer personal data to any other organisation for their own marketing purposes.
Cookies and Website Analytics
Our website uses a small number of cookies:
- Essential cookies, which make the site work (for example, remembering a cookie consent choice) and do not require consent.
- Analytics cookies (such as [Google Analytics]), which help us understand how the site is used, in an aggregated and largely anonymous form. These are only set with your consent, given through the cookie banner when you first visit.
We do not use cookies for advertising or to build profiles of visitors for marketing purposes. You can withdraw cookie consent at any time through your browser settings or the cookie preferences link in the site footer.
How Long We Keep Personal Data
We keep personal data only as long as we need it:
- Safeguarding records relating to a child or young person are kept until their 25th birthday, in line with statutory guidance and our Safeguarding Policy.
- Programme and funding records (applications, attendance, outcomes) are kept for [six] years after a programme ends, to meet funder audit and reporting requirements.
- General enquiries are kept for [two] years unless you ask us to delete them sooner.
- Newsletter contacts are kept until you unsubscribe.
- Financial records are kept for the period required by HMRC and Companies House (currently six years from the end of the relevant accounting period).
When data is no longer needed, we delete or anonymise it securely.
Your Rights
Under UK data protection law, you have the right to:
- Ask us what personal data we hold about you, and get a copy of it (the right of access).
- Ask us to correct inaccurate or incomplete data (the right to rectification).
- Ask us to delete your data in certain circumstances (the right to erasure).
- Ask us to restrict how we use your data (the right to restriction).
- Object to us using your data where we rely on legitimate interests (the right to object).
- Ask for your data in a portable format, where we process it based on consent or a contract and by automated means (the right to data portability).
- Withdraw consent at any time, where we rely on consent (for example, for the newsletter or non-essential cookies), without affecting anything we did before you withdrew it.
We do not make any decisions about you using solely automated means that have a legal or similarly significant effect, so the right to object to automated decision-making does not currently apply to how we use your data.
To exercise any of these rights, contact us using the details in How to Contact Us below. We will normally respond within one month.
Keeping Data Secure, International Transfers and Changes to This Policy
Security: We use reasonable technical and organisational measures to protect personal data, including restricting access to those who need it, using secure, password-protected systems, and storing safeguarding records separately from general participant records (see our Safeguarding Policy).
International transfers: We store personal data in the UK or the European Economic Area wherever possible. Where a service provider we use stores or processes data outside the UK (for example, [a US-based email or booking platform]), we rely on an appropriate safeguard, such as the UK International Data Transfer Addendum or the service provider’s own UK/EU adequacy arrangements.
Changes to this policy: We review this policy at least annually, or sooner if our activities or the law change. The date at the top of this page shows when it was last updated. Significant changes will be highlighted on our website or communicated directly where appropriate.
How to Contact Us
If you have a question about this policy, or want to exercise any of your rights, contact us at:
Re-Invented Limited, 60 Firs Lane, Leigh, WN7 4SB ·
hello@re-invented.org
We would, however, appreciate the chance to resolve your concern directly first.