Cheddar Youth Trust inc. The Sarah Comer Trust (Education) (CYT)
Registered Charity 1080105
1. Introduction
This Data Protection Policy outlines how the CYT handles, stores, and protects personal data collected from individuals aged 5 to 25 applying for funding. The charity is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
2. Purpose of Data Collection
We collect personal information solely for the purpose of:
- Assessing eligibility for funding
- Contacting applicants or their parents/guardians
- Distributing funds and following up on funded projects
- Reporting to trustees or funders (in anonymized or aggregated formats)
3. Types of Data Collected
We may collect and store the following types of personal data:
- Full name and age
- Contact details (address, email, phone number)
- Parent/guardian contact details (if applicant is under 18 years old)
- Details about funding needs and circumstances
- Further information supporting the application if required by the CYT
4. How Data is Collected
- Paper Applications are submitted in person or by post and stored securely in locked cabinets within a restricted-access office.
- Digital/Electronic Applications are submitted by e mail attachment to the CYT Treasurer or They are shared via email with CYT Trustees with access limited to CYT Trustees.
5. Data Storage and Protection
- Data is stored securely in accordance with best practices:
- Paper records are kept in locked storage, accessible only by Trustees or authorised persons.
- Digital data is stored on encrypted, password-protected For example,
CYT Trustee’s computers/devices.
- We conduct regular audits and update our systems to guard against data
6. Data Retention
We retain data for a maximum of 18 months from the date of application. Data is deleted from CYT Trustee’s computers/devices or shredded when no longer needed.
7. Subject Access Request (SAR) and Consent
- Consent to access personal data held by the CYT is obtained from applicants (or from a parent/guardian if the applicant is under 18).
- Individuals may request access to their data at any time, and have the right to rectification, erasure, restriction, or objection.
- We do not share personal data with third parties without explicit consent, except when legally required.
8. Data Breach Procedure
In the event of a data breach:
- We will use our best endeavours to notify affected individuals within 72 hours of becoming aware of the breach.
- We will use our best endeavours to inform the Information Commissioner’s Office
(ICO) if necessary.
- We will use our best endeavours to take remedial action to prevent future
9. Contact
If you have any questions about this policy or wish to make a data request, please contact:
Data Protection Officer
Richard A W Smith
richard.smith33@btinternet.com
07443 428329
————————-
Effective Date: 01 September 2025
Review Date: Annually at AGM