Introduction
Impact Thame is committed to protecting your personal information and respecting your privacy.
This Privacy Notice explains how we collect, use, store and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025.
For the purposes of data protection law, Impact Thame is the Data Controller.
Contact details
Data Protection Officer
Impact Thame
Black Horse Cottage
Manor Road
Towersey
THAME
OX9 3QR
Email: dpo@impactthame.org.uk

What personal information do we collect?

Volunteers
We may collect:
• Name
• Address
• Telephone number
• Email address
• Date of birth
• Emergency contact details
• DBS information
• References
• Relevant safeguarding information
• Health information where necessary for safeguarding or health and safety purposes

Parents and Children
We may collect:
• Parent or guardian names
• Contact details
• Child’s name and date of birth
• Medical or health information of children
• Additional needs information of children
• Emergency contact details
• Attendance records
• Photography permissions

Why do we use your information?
We use personal information to:
• Recruit, manage and support volunteers
• Carry out DBS checks where required
• Organise and run Impact Thame events
• Safeguard children and vulnerable individuals
• Communicate with volunteers and parents
• Manage registrations and attendance
• Respond to queries and complaints
• Maintain financial and administrative records
• Comply with legal and insurance requirements

Our lawful bases for processing
Processing Activity: Lawful Basis
• Volunteer recruitment and administration: Legitimate interests
• Event administration: Legitimate interests
• Safeguarding activities: Legitimate interests and safeguarding obligations
• DBS applications: Legal obligation and legitimate interests
• Financial administration: Legal obligation
• Marketing communications: Consent and/or charitable-purpose soft opt-in where permitted by law

For health and medical information, which is special category data, we process this information only where necessary for safeguarding, health and safety, insurance or accessibility purposes and as permitted by UK data protection law.

Marketing communications
We may send news and information about Impact Thame’s activities by email or other electronic means.
We will do this:
• where you have provided consent; or
• where we are permitted to do so under the charitable-purpose soft opt-in provisions of Privacy and Electronic Communications Regulations (PECR).
You can opt out of receiving marketing communications at any time by following the unsubscribe instructions in our messages or by contacting us.

Who do we share information with?
We may share information where necessary with:
• Trustees and authorised event leaders
• DBS processing providers
• Volunteer management systems
• Email communication providers
• Professional advisers
• Insurers
• Regulatory bodies
• Law enforcement agencies where required by law
We require any organisation processing data on our behalf to keep it secure and use it only for agreed purposes.

International transfers
Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place as required by UK data protection law.

How long do we keep information?
We retain personal information only for as long as necessary for the purposes for which it was collected and to meet legal, safeguarding, insurance and regulatory obligations.
Detailed retention periods are set out in our Data Protection Policy and retention schedule.

How do we keep information secure?
We take appropriate technical and organisational measures to protect personal information, including:
• Password-protected systems
• Restricted access to data
• Secure cloud services
• Locked storage for paper records
• Staff and volunteer training
• Regular review of security measures

Your rights
You have the right to:
• Be informed about how your data is used
• Access your personal information
• Request correction of inaccurate information
• Request erasure of information in certain circumstances
• Request restriction of processing
• Object to processing
• Request data portability where applicable
• Not be subject to unlawful automated decision-making
To exercise any of these rights, please contact the Data Protection Officer.

Subject Access Requests
You may request a copy of the personal information we hold about you.
We will normally respond within one month.
We may request proof of identity and, where necessary, seek clarification of your request. Where permitted by law, the response period may be paused while we await this information.

Automated decision-making
Impact Thame does not currently make solely automated decisions that have legal or similarly significant effects on individuals.

Complaints
If you have concerns about how we use your personal information, please contact our Data Protection Officer first.
We will investigate your concerns and respond within a reasonable timeframe.
You also have the right to complain to the Information Commissioner’s Office (ICO):
https://ico.org.uk/make-a-complaint/

Changes to this Notice
We keep this Privacy Notice under regular review and may update it from time to time.
Version: 3
Last updated: 16th July 2026