Privacy Notice

This Privacy Notice tells you what to expect Bromley Experts by Experience (Registered Charity Number 1198275 and Company Number 07976417) to do with your personal data. It also explains what your rights are and how the law protects you.

What is personal data?

Personal data is any information that may be used to identify you, such as your name and email address.

What personal data do we collect?

Data we collect may include:

  • Your name, address, email and phone number
  • Your date of birth
  • Emergency contact information
  • Information about your school or education (for our Youth Transition Project only)
  • Information on access and dietary requirements
  • Feedback or survey responses (any reports will be anonymised)
  • Social media or website interactions (please see our cookie policy for more information)
  • Payment details and taxpayer information (for donations and Gift Aid)

We may also collect the following special category personal data (sensitive data that needs extra protection):

  • Demographics information, including gender, disability, ethnicity, religion and sexual orientation
  • Details about any allergies or medical conditions we need to know about to keep you safe

Providing this special category data is optional and choosing not to provide it will not affect your ability to access our services. We only use special category personal data to provide inclusive and accessible services, monitor equality and diversity and/or to meet funder reporting requirements.

How do we collect personal data?

We collect personal data from you and family members/carers when you/they fill out a form e.g. to book a place at one of our events, enrol as a volunteer or become a member. We also collect personal data when you contact us with any queries or use our website.

For our Youth Transition Project, we may also receive information from your school, but we would only do this with your permission or if the law requires it.

Why do we collect your personal data?

We only collect your personal information when we have a good reason to. This could be to:

  • Provide you with the services you have asked for
  • Keep you safe while you are with us
  • Contact you and/or your emergency contact in an emergency
  • Get your opinion so we can improve our services
  • Monitor and report on the progress of our projects for our funders
  • Make sure our services are accessible and inclusive
  • Contact you about our work and events, and local news and opportunities

Our lawful basis for collecting and using your personal data

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal data.

We will use:

  • Legitimate interests for service delivery. This means that your personal data helps us run our services and doesn’t harm your rights.
  • Consent for photos/videos and newsletters/service updates. This means you have given permission for us to collect and use your personal data as outlined in this privacy notice.
  • Contract for membership administration.
  • Vital interests to process your personal data in an emergency.
  • Legal obligation to process your personal data to meet legal requirements, e.g. Gift Aid and safeguarding.

Will we share your personal data with anyone else?

We only share your personal data outside our organisation:

  • With trusted third-party service providers to help us deliver our services (e.g. email, cloud storage and website platforms).
  • With funders (only anonymised data)
  • Where the law requires us to
  • Where we believe you or someone else is at risk of harm

Some of our third-party service providers may store data outside the UK e.g. Mailchimp. We ensure they have the correct security protections in place to keep your data safe.

How long do we keep your data?

We will keep project records for a maximum of seven years after the project has ended.

For our Youth Transition Project, we will keep safeguarding / health and safety information until you are 25 years old. This is a legal requirement.

Membership data will be kept while your membership is active. If you choose to leave or if you do not respond to our annual renewal check, we will delete or anonymise your personal data within two years from the date our renewal was first sent.

Financial records, such as Gift Aid and donation information, will be kept for six years as this is a legal requirement. 

Anonymised project data will be kept as long as necessary.

How do we keep your personal data safe?

We use appropriate security measures to safeguard your data, but no method of transmission over the internet or electronic storage is 100% secure. We continuously monitor and improve our security measures to keep your information safe.

What are your rights?

You have the right to:

  • Be informed about how we use your information
  • Access the information we hold about you
  • Correct your information if you think it is wrong
  • Ask us to delete your information, but we may not be able to do this if we need to keep it for legal reasons
  • Object to the processing of your information
  • Ask us to limit how we can use your information
  • Ask that we transfer the personal information you gave us to another organisation or to you
  • Withdraw your consent at any time by contacting us using the details below

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. In some cases, we may extend the time limit by up to two months. We may ask for proof of identity to make sure we are not sharing your personal data with people who should not see it.

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the data protection regulator. In the UK, this is the Information Commissioner’s Office (ICO).

Bromley Experts by Experience contact details

  • Address: Room 5, Anerley Town Hall and Business Centre, Anerley Road, Anerley, SE20 8BD
  • Email: info@xbyxbromley.org.uk
  • Phone: 0208 650 2102

Information Commissioner’s Office (ICO) contact details

Updates to this Privacy Notice

This policy will need to be updated from time to time, and we will place any updates on this webpage.

Last updated: 01/06/2026

01/06/2026 – updated information on ‘How long do we keep your data?’