Cookie and Privacy Notice

We collect information we genuinely need to deliver our services, safeguard participants, meet legal duties, secure funding and show our charitable impact.

2.1 Basic details

Name, date of birth, contact details; emergency contacts.

2.2 Booking & programme information

Booking forms; attendance, assessment and certification records; school or group details.

2.3 Medical & special category information (everyone who books)

We collect medical information for all participants as part of our duty of care. This includes allergies, medical conditions, disability or additional support needs, dietary requirements, and the content of medical forms (including a declaration of no medical issues, which is still medical data). We use this to keep people safe, make reasonable adjustments and respond in emergencies.

2.4 Religious or philosophical belief (optional)

To make appropriate arrangements (for example, food requirements and access to prayer facilities), we may ask for limited information about your religion or belief. These questions are optional and you can say “prefer not to say”. We use this only to accommodate needs and foster inclusion.

2.5 Financial information

Payment details (processed securely by providers), donations and Gift Aid information.

2.6 Website & digital

Cookies/analytics, device identifiers and IP addresses.

2.7 Photos & videos

Images taken during activities (only used externally with consent); testimonials/case studies (with consent). See also safeguarding guidance.

2.8 CCTV

CCTV operates in entrances/exits, public indoor areas, operational zones and external grounds to keep people safe and protect property (never in bedrooms, bathrooms, toilets, showers or changing rooms).

2.9 Body-worn cameras (BWC)

For safeguarding, welfare and incident response, trained staff may use body-worn video in specific contexts. We follow our Body Worn Camera Procedure based on the Surveillance Camera Code’s 12 principles (announcements, limited use, secure storage, short retention). BWCs are not used in private spaces.

2.10 Demographic, funding & impact information

We collect limited information to assess eligibility, monitor inclusion and demonstrate impact:

· Funding applications (children & young people): nonidentifying, group level data (e.g., socioeconomic indicators, school demographic profiles) to check eligibility and allocate support fairly. We don’t collect names at this stage.

· Optional demographic questions (medical forms): Free School Meals/Pupil Premium/Universal Credit, EAL, care/caring, armed forces affiliation, ethnicity. These are optional with a clear optout.

· Anonymised programme level data: e.g., SEND, mental health indicators, neurodiversity, water confidence. We analyse only in groups large enough to protect identity.

· Adult careers funding: employment status, income/outgoings (and, rarely, parental income) to assess eligibility per funder rules.

This supports fair access, evaluation and funding reports.

2.11 Internet filtering and monitoring

To help keep our systems secure, protect children and vulnerable people, and ensure appropriate use of our IT systems, we use an internet filtering and monitoring system. When you use our network or organisation‑managed devices, this system may record:

· websites and URLs accessed or attempted

· search terms entered into search engines; and

· attempts to access blocked or restricted content.

This information is linked to a user account or device.

We rely on different lawful bases depending on the activity:

Contract – to process bookings, deliver programmes safely and provide essential updates.

Legal obligation – to meet duties to regulators/authorities/accrediting bodies (e.g., Ofsted, ESFA, RYA, MCA, HMRC).

Vital interests – for emergencies and safeguarding life.

Legitimate interests – to run UKSA effectively: safety/security; improving services; alumni contact; postal marketing; email/SMS under PECR soft opt-in; CCTV; body-worn cameras for safeguarding and incident response; maintaining IT security, preventing access to illegal or harmful online content, and supporting safeguarding through proportionate internet filtering and monitoring; anonymised impact reporting. We balance our interests with your rights.

Consent – for email/SMS marketing (where soft opt-in doesn’t apply), fundraising messages, identifiable photos/video, optional religion/belief questions, optional demographic questions, surveys/case studies. You can withdraw consent any time.

Public interest / safeguarding – where required to protect children or vulnerable adults (see UKSA safeguarding policy and procedures [link]).

Special category data conditions (Article 9 UK GDPR)

• Health data: explicit consent and/or vital interests; safeguarding/health & care conditions in DPA 2018 Schedule 1 (where applicable).
• Religion/belief: explicit consent; and, where appropriate, substantial public interest (equality of opportunity or treatment) under DPA 2018 Schedule 1 with an Appropriate Policy Document.
• Equality/inclusion monitoring: substantial public interest (equality of opportunity) with safeguards and an Appropriate Policy Document.

Criminal offence data

If recordings (e.g., BWC/CCTV) or capture potential criminal offence data, we rely on DPA 2018 Schedule 1 substantial public interest conditions such as preventing or detecting unlawful acts, with safeguards, DPIA and access controls in place.