Introduction
Power2 (“we”, “us”, “our”) is committed to protecting the privacy and personal data of everyone who interacts with us. This Privacy Policy explains how we collect, use, store, and protect your personal data when you:
- Visit our website
- Use our services
- Participate in our programmes or interventions
- Contact us by email, phone, post, social media, or web forms
- Donate or purchase items through our website
Power2 processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025. These laws require us to identify a lawful basis for every use of personal data. Depending on the context, we may rely on consent, performance of a contract, legal obligation, vital interests, public task, or our legitimate interests, including the recognised legitimate interests introduced under the Data (Use and Access) Act 2025 such as safeguarding individuals at risk and preventing fraud. We explain these lawful bases in more detail throughout this Policy.
Your use of our website constitutes agreement with our Terms & Conditions, which operate alongside this Privacy Policy.
We will ask you to consent to our use of cookies in accordance with this Policy when you first visit our website.
Our use of cookies is explained in our Cookie Statement, which forms part of this Policy.
Who we are
Power2 is a charity registered in England and Wales (No. 1099782).
Registered office: 26a Warrington Street, Ashton‑under‑Lyne, Tameside, OL6 6AS
Contact us:
- Email: info@power2.org
- Telephone: as listed on our website
- Post: to the address above
We are the “data controller” responsible for your personal data.
Categories of personal data we collect
We may collect, store, and process the following categories of personal data. These reflect both historic data collection and current operational needs.
In addition to the specific purposes for which we may process your personal data set out in this Section 3, we may also process any of your personal data where such processing is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may process any of your personal data identified in the other provisions of this policy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.
Please do not supply any other person’s personal data to us, unless we prompt you to do so.
Usage data
Collected automatically when you use our website:
- IP address
- Browser type and version
- Operating system
- Device identifiers
- Geographical location
- Referral source
- Pages viewed, time spent, navigation paths
- Interaction data (clicks, scrolls, behaviour patterns)
Lawful basis: legitimate interests (website performance, monitoring misuse).
Account data
- Name
- Email address
- Login credentials (where applicable)
- Communication preferences
Lawful basis: consent or performance of a contract.
Profile data
- Name
- Postal address
- Telephone number
- Email address
- Profile photos (if provided)
- Gender
- Date of birth
- Social media identifiers
Lawful basis: consent.
Service/programme participation data
Information provided during participation in Power2 programmes, interventions, mentoring, or workshops:
- Personal details provided in forms
- Case notes or assessment outcomes
- Attendance records
- Feedback or evaluation data
- Support needs or adjustments
Lawful bases: performance of a contract, legitimate interests, legal obligation (safeguarding), consent.
Safeguarding & special category data
Only collected where essential for service delivery or protection of vulnerable individuals:
- Health information (mental or physical)
- Ethnicity
- Disabilities and accessibility needs
- Welfare concerns
- Incident reports
- Information from social workers, schools, or safeguarding bodies
- Data relating to risk or harm
Lawful bases:
- Explicit consent, or
- Substantial public interest (specifically schedule 1 “safeguarding of children and individuals at risk”)
(These purposes align with recognised legitimate interests under the Data (Use and Access) Act 2025, including safeguarding individuals under 18 or at risk.)
Publication data
- Testimonials
- Case studies
- Photographs or videos you provide
- Blog comments or contributions
Lawful basis: consent.
Enquiry data
- Contact details
- Content of enquiry or request
- Preferences
Lawful basis: legitimate interests or consent.
Transaction data
- Name and contact details
- Donation or purchase information
- Gift Aid declarations
- Payment details (processed securely through payment providers)
Lawful bases: contract, legal obligation, legitimate interests.
Notification data
- Email address
- Subscription preferences
Lawful basis: consent.
Correspondence data
- Email or message content
- Communication metadata (including timestamps, IP addresses from forms)
Lawful basis: legitimate interests.
Data from third parties
We may receive information from:
- Schools, local authorities, youth agencies, commissioners
- Fundraising platforms
- Social media platforms
- Payment processors
- Public data sources
- Partner organisations
How we use your personal data
We use personal data to:
- Deliver and manage programmes and services
- Process donations, payments, and Gift Aid
- Respond to enquiries
- Communicate with supporters and service users
- Marketing communications separated into:
- service-related updates
- fundraising communications
- Research/statistical reporting
- Improve service quality and website performance
- Ensure safeguarding and statutory compliance
- Maintain internal documentation and records
- Personalise website content
- Meet regulatory, financial and legal duties
We do not sell your personal data.
Legal bases for processing
We rely on:
- Consent
- Performance of a contract
- Legitimate interests
- Legal obligation
- Vital interests
- Recognised legitimate interests (introduced under the DUA Act 2025, including safeguarding, fraud prevention, emergency response).
Cookies and similar technologies
Our website uses essential, analytical, and preference cookies. We use both first‑party and third‑party cookies as described in our Cookie Statement.
Most web browsers allow you to refuse or delete cookies, although doing so may affect the functionality of this website.
You can manage your preferences at any time via the on‑site cookie tool or through your browser settings.
Sharing your personal data
We may share your data with:
- Website hosting and IT providers
- Analytics and cookie service providers
- Partner schools, youth agencies or authorities (for programme delivery)
- Payment processors (Stripe, GoCardless, PayPal)
- Professional advisers
- Regulators and safeguarding authorities
- Law enforcement where legally required
We may also disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes or to the purchaser (or prospective purchaser) of any business or asset that we are (or are contemplating) selling.
Financial transactions relating to our website and services are handled by Stripe, GoCardless and PayPal. We will share transaction data with our payment service providers only to the extent necessary to process payments, refunds and related complaints and queries. Please refer to their privacy notices for further information.
Our website provider may process personal data on our behalf for the purposes of hosting, maintenance, analytics, service development and technical support, subject to appropriate and contractual safeguards. This may include connecting data we receive from you on the website to data available.
In addition to the specific disclosures of personal data set out in this Section 4, we may also disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
Where third parties act as processors, they must comply with strict confidentiality, security, and data protection requirements. We are not responsible for the privacy policies of third-party websites even where we provide links to them. We recommend that you read the privacy policy of any third-party website before providing personal data.
International transfers
If data is transferred outside the UK, we ensure appropriate safeguards via:
- Adequacy regulations
- Standard Contractual Clauses (SCCs)
- Appropriate additional measures where required
Data retention
We retain personal data only as long as necessary for:
- Service delivery
- Legal and financial obligations
- Safeguarding
- Regulatory requirements
Personal data that we process for any purpose, or purposes shall not be kept for longer than is necessary for that purpose or those purposes. We will retain your personal data in accordance with record retention and disposal policy. A typical retention period is 7 years; at the end of which period it will be deleted from our systems.
Notwithstanding the other provisions of this Section 5, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
Your rights
You have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request erasure
- Object to processing
- Request restriction of processing
- Request portability where applicable
- Withdraw consent at any time where processing is based on consent
- Raise a complaint to the ICO
Under the DUA Act 2025, we are required to conduct reasonable and proportionate searches when responding to Data Subject Access Requests (DSARs).
Complaints
If you have concerns, you should contact us first, as required under the Data (Use and Access) Act 2025. If you remain dissatisfied, you may contact the Information Commissioner’s Office (ICO): https://ico.org.uk
If you have a complaint about our fundraising activities you can also complain to the Fundraising Regulator: https://www.fundraisingregulator.org.uk/
Children’s data
Our website is targeted at people over the age of 13. If we have reason to believe that we hold personal data obtained via our website of a person under that age in our databases, we will delete that personal data.
Programme‑related children’s data is processed under robust safeguarding measures.
Links to external websites
Our website may include links to third‑party websites. We are not responsible for their content or privacy practices, as outlined in our Terms & Conditions.
We operate a number of social media pages (including Facebook, BlueSky, YouTube and Instagram). Although this policy covers how we will use any data collected from those pages it does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of the social media website before sharing data and make use of the privacy settings and reporting mechanisms to control how your data is used.
Security
We implement appropriate administrative, technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. .
Updating information
Please let us know if the personal information we hold about you needs to be corrected or updated.
Updates to this policy
We may amend this Privacy Policy periodically. Updates will be published on our website, with significant changes communicated where appropriate.
