WorkUp Privacy Policy
Last updated: Dec 2025
WorkUp(“WorkUp”, “we”, “us”, “our”) is committed to protecting your personal information and respecting your privacy. This policy explains how we collect, use, store, and protect your personal information, and the rights you have over the information we hold about you.
We may update this Privacy Policy from time to time. Any changes will be posted on this page, and the “last updated” date will indicate when revisions were made.
1. Who We Are
WorkUp is a Charitable Incorporated Organisation (CIO), registered with the Charity Commission in England and Wales (Registered No.1214912).
For the purposes of data protection law, WorkUp is the **Data Controller of the personal information we collect.
2. What Personal Information We Collect
The type of personal information we collect depends on your relationship with us. We typically collect:
* Name
* Postal address
* Email address
* Telephone number
Depending on the context, we may also collect additional information, such as:
* Date of birth
* Gender
* Demographic details
* Background and eligibility information for programme applications
* Financial information related to donations (processed securely by third-party payment providers)
Where we collect special category data (e.g. ethnicity, disability, sexual orientation, religious beliefs), we will request your explicit consent.
More detailed information for beneficiaries and supporters is included in the Appendix.
3. How We Use Your Personal Information
We process personal information to support our charitable objectives. Typical purposes include:
a. Running our programmes
We collect personal information when you apply for or participate in our programmes, so that we can assess eligibility, deliver services, and evaluate the success and reach of our work.
b. Marketing and communications
With your consent, we use your information to send newsletters, updates, promotional materials, and information about our activities.
We may also collect information from partners or stakeholders to raise our profile across social media, printed materials, video, and other communication channels.
c. Networking and partnership building
We maintain contact details for stakeholders, funders, industry partners, and peer organisations to support collaborative working and advocate for our charitable aims.
d. Fundraising
We process donor information to manage and acknowledge donations, run fundraising campaigns, maintain accurate records, and improve our fundraising strategy.
e. Website use
We collect certain technical data through cookies and analytics tools to understand how visitors use our website. See our Cookie Policy for more details.
You do not need to disclose personal information to browse our website, but some services may not be available without it.
4. Legal Bases for Processing
We process your personal information under the following legal bases:
a. Consent
Where legally required (e.g., marketing communications, special category data), we will only process your information with your freely given, informed consent.
b. Contract
Where processing is necessary to fulfil a contract with you, such as delivering a programme place you have accepted.
c. Legal obligation
For compliance with legal or regulatory requirements, including financial reporting or safeguarding.
d. Legitimate interests
We may process your information where it is within our legitimate interests to do so and not overridden by your rights. These interests include:
* Delivering our charitable activities
* Promoting our work
* Evaluating and improving our programmes
* Maintaining relationships with supporters, partners, and stakeholders
* Ensuring the security and integrity of our systems
See our Legitimate Interest Policy for more detail.
5. How We Obtain Your Information
We collect information:
* Directly from you (forms, emails, phone calls, events, etc.)
* When you give consent to another organisation to share it with us (e.g., Facebook, Twitter)
* When you interact with our website
* Via trusted third parties when you have allowed them to pass your information to us
* From publicly available sources, to keep records accurate and up to date
We may combine information from these different sources to improve its accuracy and usability.
6. Children’s Information
If you are under 18, please ensure a parent or guardian provides consent before you send any personal information to us or participate in our activities.
We strongly encourage parents and guardians to supervise their children’s online activity and to advise them not to share personal information without permission.
7. Where Your Information Is Stored
We primarily process and store personal information within the UK and EEA.
However, some service providers (e.g., Mailchimp, Stripe) may store data outside the UK/EEA.
Where this occurs, we ensure appropriate safeguards are in place in accordance with GDPR and ICO guidance.
8. Sharing Your Information
We do not share your personal information with third parties except:
* Where you have given consent
* When legally required to do so (e.g., law enforcement, tax authorities)
* When running events or activities in partnership with other named organisations
* When working with trusted suppliers who provide services on our behalf, such as:
* Mailchimp (mailing list services)
* Stripe (payment processing)
* Bookkeepers and independent examiners
These organisations only process your information under our instruction and in compliance with GDPR.
We will never sell or rent your personal information.
Aggregate, anonymised statistics may be shared with funders or partners, but these will never identify individuals.
9. How Long We Keep Your Information
We retain personal information only as long as necessary for the purpose it was collected, in line with our retention policy.
If you request no further contact, we retain minimal information to ensure we can honour your request and avoid accidental communication.
Details of retention periods for beneficiaries and supporters are provided in the Appendix.
10. Your Rights
Under data protection law, you have the following rights:
‘Right to be informed’ – clear information about how your data is used
‘Right of access’ – request a copy of the data we hold about you
‘Right to rectification’ – correct inaccurate or incomplete data
‘Right to restrict processing’ – limit how we use your data
‘Right to erasure’ – ask us to delete your data (“right to be forgotten”)
‘Right to object’ – particularly to marketing
‘Right to data portability’ – transfer your data to another provider
‘Rights related to automated decision-making’ – we do not conduct automated decisions or profiling
More information is available at the ICO website.
You may withdraw consent at any time.
11. Contacting Us
If you wish to exercise your rights, update your preferences, request access to your information, or discuss this policy, please contact:
WorkUp – Managing Director (Helena Jarrold)
Email: helena@workup.org.uk
If you are unhappy with how we handle your personal information, you may complain to the Fundraising Regulator or the Information Commissioner’s Office (ICO).
Appendix: More Detail on How We Use Information
A. Beneficiaries
We collect personal information when individuals apply for or enquire about our charitable programmes. For the Access Group programmes, this includes:
* Name, email, phone number
* Age (typically 17–30)
* Geographic location
* Eligibility details (financial background, education status, citizenship/residency)
* Written or video personal statements
* Equal Opportunities Monitoring Form data (used anonymously for statistical purposes only)
Monitoring data may include special category data (gender, ethnicity, disability, religion, sexual orientation, care-leaver status). This is collected only with explicit consent and is not seen by programme selectors.
Retention period:
Successful applicants: six years
Unsuccessful applicants: two years
We may use written, audio, photographic, or video materials from participants in our fundraising and promotional activities, with appropriate consent.
Some information may be shared with partner organisations when necessary to deliver programme activities (e.g. participant name lists for open days). We will always inform participants when this is the case.
All data is stored and used in line with our internal Data Protection Policy.
B. Supporters
We collect and retain personal information from donors and supporters to manage donations and support relationships. Correspondence via email, telephone, post, and social media may also be retained to ensure high-quality supporter care.
Online donations are processed through PayPal which operate their own secure systems and may transfer data outside the UK/EEA.
Supporters should review their individual privacy policies.
WorkUp cannot be held responsible for loss or damage arising from third-party platforms.