Who we are
Carmarthen Youth Project (known as Dr Mz) is a registered charity that works with young people aged 10–25 from Carmarthen and surrounding areas. We are the data controller for the personal information we collect about our members, their parents and guardians, and visitors to our project.
We are registered with the Information Commissioner’s Office (ICO). Our registration number is Z7172366.
Our address is: The Club House, Friars Park, Carmarthen, SA31 3AN
Charity number: 1124727. Company number: 06229911.
What Information We Collect
We collect the following information about young people who become members of Dr Mz:
- Name (including preferred name/nickname)
- Date of birth
- Gender and pronouns
- Address and postcode
- Ethnicity
- Religion
- Preferred language
- Employment status
- Interests and hobbies
- Allergies and medical conditions
- Learning difficulties, special needs or disabilities
- Name and contact details of allocated social worker (if applicable)
- Name and contact details of GP surgery
- Photographs (with permission)
We also collect the following information about parents, guardians and foster carers:
- Enw
- Relationship to the young person (parent, guardian, foster carer)
- Email address
- Phone number
- Address (if different from the young person)
- Communication preferences
When young people sign in to sessions at Dr Mz, we record their name, the date and time of attendance, and a mood/wellbeing check-in. For new members signing in for the first time, we also collect the name and organisation of any support worker involved with the young person.
Why We Collect This Information and Our Legal Reasons
Data protection law says we need a legal reason for collecting and using personal information. The reasons we rely on depend on what we’re using the information for.
Keeping young people safe and running the service
We collect most of the information on our membership form so that we can keep your child safe while they are at Dr Mz, contact you in an emergency, and support your child’s needs (for example, by being aware of medical conditions or learning difficulties).
Legal reason: Legitimate interests. Our interest is in safeguarding young people, contacting parents or guardians in an emergency, and running a safe and effective youth project.
Health, medical, and other sensitive information
Some of the information we collect is classed as “special category” data under data protection law. This includes information about health and medical conditions, allergies, learning difficulties and disabilities, ethnicity, and religion. We collect this because:
- Health, medical, and learning difficulty information is needed to keep young people safe and to make sure we can support their needs while they are at Dr Mz.
- Ethnicity and religion information helps us monitor equality and diversity across our services.
Legal reason: Substantial public interest, specifically the safeguarding of children and individuals at risk (Schedule 1, Part 2, Paragraph 18 of the Data Protection Act 2018) and equality of opportunity monitoring (Schedule 1, Part 2, Paragraph 8 of the Data Protection Act 2018).
Photographs
We ask for your permission to photograph your child for use in leaflets, newsletters, press releases, posters, and social media. You can say no, and you can change your mind at any time by contacting us.
Legal reason: Consent. Parental consent is sought for young people up to the age of 16.
Keeping you informed about activities and news
If you choose to receive updates about Dr Mz’s activities, news, and events, we will use your contact details for this purpose. You can opt out at any time by contacting us.
Legal reason: Consent. You choose your communication preferences when completing the membership form.
Youth Engagement and Progression Framework (YEPF)
Dr Mz is a partner organisation in the Carmarthenshire Youth Engagement and Progression Framework (YEPF). The YEPF is a multi-agency partnership coordinated by Carmarthenshire County Council’s Youth Support Service. Its purpose is to identify young people who are at risk of disengaging from education, employment or training (becoming NEET), and to coordinate support for them.
As part of the YEPF, we may share information about young people with other partner organisations. The information shared may include personal details (name, date of birth, address), education and training history, barriers to learning, wellbeing indicators, and any safeguarding or risk concerns. Only the minimum necessary information is shared, and only when it is relevant to supporting the young person.
Legal reason: Public task. The YEPF operates under the legal authority of the Local Government Act 2000, the Learning and Skills Act 2000, and the Education Act 2004, among other legislation. Data sharing between YEPF partners does not rely on consent – it is carried out because the partner organisations have a duty to support young people in the public interest.
The YEPF partner organisations are:
- Cyngor Sir Caerfyrddin
- Pembrokeshire County Council
- Swansea City & County Council
- Ceredigion County Council
- Neath & Port Talbot County Borough Council
- Careers Wales
- Coleg Sir Gâr & Coleg Ceredigion
- Carmarthenshire Working
- Communities 4 Work +
- Foothold Cymru
- Inspire Training
- LRC Training
- MPCT
- Barod Cymru / Cyfle Cymru / Choices
- Carmarthenshire Leaving Care
- Iechyd Da (NHS)
- Plant Dewi
- Pobl
- Carmarthenshire Crossroads Young Carers
- Carmarthenshire secondary schools
Full details of the YEPF information sharing arrangements are set out in the Carmarthenshire Youth Engagement and Progression Framework Information Sharing Protocol (ISP), which is available on request.
Who Else We Share Your Information With
Other than through the YEPF described above, we will not share your information with anyone outside of Dr Mz unless:
- You have given us permission to do so
- We need to for safeguarding reasons (for example, if we have concerns about a young person’s safety)
- The law requires us to (for example, in response to a court order or a request from the police)
How We Store Your Information
Membership data collected through our online forms is stored on Google Sheets and our Views database. Both are password-protected and access is restricted to authorised staff.
Our sign-in/sign-out app is hosted by Vercel and uses Google Sheets as its database. Information collected through the app is treated with the same security measures as all other membership data.
Paper sign-in forms from sessions are stored in a locked cupboard at Dr Mz.
We take the security of your information seriously and have measures in place to prevent unauthorised access, loss, or damage. All staff and volunteers receive training on data protection and are required to follow our Data Protection Policy and Confidentiality Policy.
How Long We Keep Your Information
We keep membership and personal data for two years after a young person stops using our services.
Information relating to child safeguarding concerns is kept for 80 years, in line with statutory guidance.
DBS (Disclosure and Barring Service) information for staff and volunteers is kept for up to six months after a recruitment decision is made, then securely destroyed.
Information about unsuccessful job applicants is kept for three months after the recruitment process.
Your Rights
Under data protection law, you have the following rights:
- The right to be informed about how we use your personal information (this notice).
- The right to access the personal information we hold about you.
- The right to ask us to correct information that is inaccurate or incomplete.
- The right to ask us to delete your information in certain circumstances.
- The right to ask us to restrict how we use your information in certain circumstances.
- The right to object to us using your information in certain circumstances.
- Where we are using your information based on consent, the right to withdraw that consent at any time.
Young people aged 13 and over can exercise these rights themselves. For younger children, a parent or guardian can exercise these rights on their behalf.
If you would like to exercise any of these rights, please contact us using the details below.
Children and Young People
Dr Mz works with young people aged 10–25. We take the privacy of children and young people very seriously. Under our policy, young people aged 13 and over can provide their own consent where consent is the legal reason for processing. For children under 13, a parent or guardian must give consent. Parental consent is sought for the use of photographs of young people up to the age of 16 for social media and publicity purposes.
Our Website
Our website (www.drmz.co.uk) uses cookies to help it work properly. If you leave a comment on the site, we collect the data shown in the comments form, your IP address, and your browser details to help with spam detection. Embedded content from other websites (such as videos) may also collect data about you. For more information about cookies, please see your browser’s help pages.
Changes to This Notice
We may update this privacy notice from time to time. Any changes will be published on this page. We encourage you to check this notice regularly.
Cysylltu â ni
If you have any questions about this privacy notice or about how we use your information, please contact:
Alison Harbor, General Manager
Carmarthen Youth Project (Dr Mz)
The Club House, Friars Park, Carmarthen, SA31 3AN
Telephone: 01267 222786
Email: [email protected]
If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner’s Office (ICO):
Telephone: 0303 123 1113
Website: www.ico.org.uk