Skip to content Skip to footer
Close
Full Privacy Policy

Youth Community Support Agency (YCSA)

Last updated: January 2025

  1. Who we are

Youth Community Support Agency (YCSA) is a charitable organisation based in Glasgow, Scotland. We support children, young people and families from Black and Minority Ethnic, refugee and asylum seeking communities through mental health support, creative therapy, family services and community engagement.

YCSA is the data controller for the personal information collected through our website and services.

Contact details:

Email: enquiries@ycsa.org.uk

  1. Our commitment to your privacy

YCSA is committed to protecting your privacy and handling personal data lawfully, fairly and transparently. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We only collect personal data where it is necessary, relevant and proportionate to the services we provide.

  1. What personal data we collect

Depending on how you interact with us, we may collect the following information:

a) Website enquiries and contact forms

  • Name
  • Email address
  • Telephone number
  • Message content

b) Service users (children, young people and families)

  • Name and contact details
  • Date of birth (where relevant)
  • Family and household information
  • Information related to wellbeing, support needs or mental health
  • Education or school details
  • Referral information

c) Professionals and partners

  • Name
  • Organisation
  • Role
  • Contact details

d) Volunteers and staff

  • Contact details
  • Recruitment and vetting information
  • PVG and safeguarding related information (where required)
  1. Special category (sensitive) data

Some of the data we process is classed as special category data, including information about health, mental wellbeing, ethnicity, or safeguarding concerns.

We only process this information where:

  • it is necessary to provide support or services
  • we have explicit consent, or
  • we are required to do so by law or safeguarding obligations

We take additional care and security measures when handling sensitive data.

  1. How we use personal data

We use personal information to:

  • Respond to enquiries and requests
  • Provide support and services to children, young people and families
  • Deliver mental health and wellbeing programmes
  • Manage referrals and partnerships
  • Safeguard children, young people and vulnerable adults
  • Meet legal, regulatory and funding requirements
  • Improve our services and reporting

We do not sell or misuse personal data.

  1. Lawful basis for processing

Under UK GDPR, we process personal data using one or more of the following lawful bases:

  • Consent- where you have given clear permission
  • Contract – where processing is needed to deliver a service
  • Legal obligation- where required by law (e.g. safeguarding)
  • Vital interests- to protect someone’s life or wellbeing
  • Legitimate interests- where it is reasonable and expected
  1. Consent

Where consent is required, it will be:

  • clear and specific
  • freely given
  • capable of being withdrawn at any time

You can withdraw consent by contacting us at enquiries@ycsa.org.uk.

  1. Who we share data with

We only share personal data where necessary and appropriate. This may include:

  • Schools and education providers
  • Health and social care professionals
  • Local authorities or statutory services
  • Funders (in anonymised or aggregated form where possible)
  • Safeguarding agencies where there is a concern for safety

We never share data unnecessarily and only with organisations that follow data protection law.

  1. Safeguarding and legal disclosure

In some circumstances, we may need to share information without consent, for example:

  • if there is a safeguarding concern
  • to prevent harm
  • where required by law

Any such disclosure is handled carefully and proportionately.

  1. Data retention

We only keep personal data for as long as necessary.

Retention periods depend on:

  • the type of data
  • legal and safeguarding requirements
  • funding and reporting obligations

Once data is no longer required, it is securely deleted or anonymised.

  1. Data security

We take appropriate technical and organisational measures to protect personal data, including:

  • secure systems and password protection
  • restricted access to sensitive information
  • staff and volunteer training
  • secure storage of physical records
  1. Your rights

Under UK GDPR, you have the right to:

  • access your personal data
  • request correction of inaccurate data
  • request deletion (where applicable)
  • restrict or object to processing
  • withdraw consent
  • lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise your rights, contact us at enquiries@ycsa.org.uk.

  1. Cookies and website analytics

Our website may use basic cookies to ensure it functions properly and to understand how visitors use the site.

We do not use cookies to identify individuals.

You can control cookies through your browser settings.Note

  1. Children’s data

We take extra care when handling data relating to children and young people. Where required, consent will be obtained from a parent, carer or legal guardian.

Safeguarding and wellbeing always take priority.

  1. Changes to this policy

We may update this Privacy Policy from time to time. Any significant changes will be posted on this page.

  1. Contact us

If you have any questions about this Privacy Policy or how your data is handled, please contact: enquiries@ycsa.org.uk