Privacy Policy
AllStar Privacy Notice
Last updated: 14 July 2026
________________________________________
A quick summary for children and young people
AllStar keeps some information about you—such as your name, age, contact details and information about how you are doing—so that we can support you properly and help keep you safe.
We only ask for information that we genuinely need, and we must have a lawful reason for collecting, using or sharing it.
We may receive information from you, your parent or carer, your school, your GP, the NHS, social care or another organisation supporting you.
We may sometimes share relevant information with people who help support or protect you, but only where this is necessary and legally permitted.
We also provide information to organisations that fund or commission our work. We normally use anonymous or combined information that does not identify you. Where identifiable information is required, we only share what is necessary and must have a lawful reason.
We do not sell your information.
You can ask:
• what information we hold about you;
• for a copy of it;
• for incorrect information to be corrected;
• why it is being used;
• for us to stop using or delete it in some circumstances.
There is no fixed age at which you can exercise these rights yourself. What matters is whether you understand the request and what it may mean. A parent, carer or trusted adult can help you.
You will not get into trouble or lose support because you ask about your information or make a complaint.
________________________________________
1. Who we are
AllStar is a community organisation based in Bradford, West Yorkshire, working in creative industries, health and wellbeing, employability, enterprise, community development and youth services.
For data-protection purposes, AllStar is normally the data controller. This means that we decide what personal information we collect and why we use it.
Registered legal name: All Star Ents Ltd
Company number: 08032023
ICO registration number: ZB559027
Address: AllStar, Unit 12, Park View Court, St Paul’s Road, Shipley, BD18 3DZ
Email: info@allstarents.co.uk
Telephone: 01274 073604
For some commissioned services, AllStar may work with another organisation that also has responsibility for personal information. Where this applies, we will explain the arrangement through the relevant service information.
Data Protection Lead
AllStar has appointed a Data Protection Lead who oversees data-protection compliance.
Email: dpo@allstarents.co.uk
________________________________________
2. What this notice covers
This notice explains:
• what personal information we collect;
• where it comes from;
• why we use it;
• the lawful bases we rely upon;
• who we share it with;
• how long we keep it;
• how we protect it;
• your rights;
• how children and young people can exercise their rights;
• how to make a complaint.
It applies to people who use or are referred to AllStar services, parents and carers, participants in projects and activities, website users, visitors, applicants, staff and volunteers.
Separate privacy information may be provided for particular services, employees, CCTV or online platforms.
________________________________________
3. What information we collect
The information we collect depends on the service or activity involved. It may include:
Category Examples
Basic details Name, preferred name, date of birth, address and contact details
Family and carer details Parent, guardian, next-of-kin and emergency-contact details
Referral and service records Referral information, attendance, assessments, plans, reviews, notes and outcomes
Health and wellbeing Physical and mental health, disability, medication, allergies and support needs
Education and employment School, college, qualifications, training and employment information
Equality information Ethnicity, disability, religion, sex, gender identity and sexual orientation
Safeguarding and risk Safeguarding concerns, incidents, risks and protective arrangements
Criminal-offence information Allegations, police involvement, cautions or convictions where necessary
Media information Photographs, video, audio, interviews and creative work
Digital information Online forms, emails, IP addresses, cookies and system records
CCTV Images recorded at designated AllStar premises
Employment and volunteering Applications, references, DBS information and employment records
Health, ethnicity, disability, religion and sexual orientation are examples of special category data.
This information receives additional legal protection.
Information about criminal allegations, offences and convictions is also subject to additional legal requirements.
________________________________________
4. Where we obtain information
We may collect information directly from:
• you;
• your parent, carer or guardian;
• forms, meetings and conversations;
• your participation in an AllStar service;
• our website or online systems;
• CCTV and security systems.
We may also receive information from:
• schools and colleges;
• GPs and other health professionals;
• NHS organisations;
• Child and Adolescent Mental Health Services;
• social care and local authorities;
• safeguarding organisations;
• police, courts or probation services;
• referral organisations;
• funders and commissioners;
• community organisations and delivery partners;
• employers and employment-support services.
Where information comes from another organisation, we will provide appropriate privacy information unless the law allows an exception.
________________________________________
5. Why we use information and our lawful bases
We may use personal information to:
• respond to enquiries and referrals;
• deliver, plan and review support;
• communicate with participants, families and professionals;
• make reasonable adjustments;
• keep people safe and respond to safeguarding concerns;
• manage trips, activities and emergencies;
• monitor attendance, progress and outcomes;
• evaluate and improve services;
• report to funders and commissioners;
• manage complaints and incidents;
• protect our premises and computer systems;
• manage staff, volunteers and finances;
• meet legal, contractual and regulatory requirements.
We must have a valid lawful basis whenever we use personal information. Depending on the activity, we may rely on:
Legitimate interests
Where using information is necessary to provide safe and effective services, maintain appropriate records, improve our work, protect people and systems or manage AllStar effectively.
Before relying on legitimate interests, we consider whether the use is necessary, what the person would reasonably expect and the possible effect on them. We give additional consideration to children and vulnerable people.
Public task
Where AllStar carries out a specific public-interest function that has a clear basis in law.
Contract
Where using information is necessary to enter into or carry out an agreement with the individual.
Legal obligation
Where we must use or retain information to comply with the law.
Vital interests
Where using information is necessary to protect someone’s life or respond to a serious emergency.
Consent
Where the person has a genuine choice and gives clear, informed permission.
Consent may be withdrawn by telling a member of staff, contacting the Data Protection Lead or using an unsubscribe option where provided.
Withdrawing consent does not affect information that was lawfully used before consent was withdrawn.
Consent is not normally used for essential safeguarding or core service-delivery activities where there is no genuine choice.
AllStar maintains internal records showing the lawful basis used for each service.
________________________________________
6. Special category and criminal-offence information
Where we use special category information, we must identify an additional legal condition.
Depending on the activity, this may include:
• providing health or social care where the legal requirements are met;
• safeguarding children or individuals at risk;
• equality of opportunity or treatment;
• employment and social-protection obligations;
• protecting someone’s vital interests;
• establishing, exercising or defending legal claims;
• explicit consent where appropriate.
We only rely on the health and social-care condition where the service genuinely involves health or social-care provision, the information is necessary and appropriate confidentiality arrangements are in place.
General wellbeing, youth work, creative or employability activities do not automatically qualify as health or social care.
We may use criminal-offence information where necessary for safeguarding, safer recruitment, serious incident management, legal claims or cooperation with authorised bodies.
We only use this information where an appropriate lawful basis and Data Protection Act 2018 condition apply.
Where legally required, AllStar maintains an Appropriate Policy Document explaining how sensitive information is protected, retained and deleted.
________________________________________
7. Required and optional information
Some information is necessary so that we can:
• identify and contact you;
• assess a referral;
• provide support safely;
• make reasonable adjustments;
• respond to health needs or emergencies;
• meet safeguarding, legal or contractual requirements.
If essential information is not provided, we may be unable to offer a particular service, trip or activity safely.
Optional information may include:
• some equality-monitoring questions;
• optional feedback;
• promotional photography and media consent;
• marketing communications.
Declining an optional request will not normally affect access to a core service.
________________________________________
8. Who we share information with
We do not sell personal information.
Where necessary and legally permitted, we may share information with:
• parents, carers, guardians or authorised representatives;
• GPs and other health professionals;
• NHS organisations;
• Child and Adolescent Mental Health Services;
• schools and colleges;
• social care and local authorities;
• safeguarding organisations;
• police, emergency services, courts and regulators;
• funders, commissioners and delivery partners;
• awarding or accreditation bodies;
• insurers, auditors and legal advisers.
We may also use providers of:
• cloud storage, email and office systems;
• case-management systems;
• online forms and surveys;
• website hosting;
• IT support and cybersecurity;
• payroll and accounting services;
• secure disposal and archiving;
• transport, venues and activities;
• photography and creative production.
Organisations processing information on our behalf must only use it for the agreed purpose and must protect it appropriately.
Parents and carers
Information about a child is not automatically shared with a parent or carer.
We consider:
• the child’s maturity and understanding;
• parental responsibility;
• the nature of the information;
• the child’s wishes and best interests;
• confidentiality;
• safeguarding risks;
• legal requirements.
Safeguarding
We may share information without consent where this is necessary to protect a child or adult at risk, respond to serious harm, obtain emergency assistance, comply with the law or cooperate with an authorised investigation.
Where appropriate and safe, we will explain what is being shared and why.
________________________________________
9. Reporting to funders and commissioners
Funders and commissioners may require information about:
• numbers of people using a service;
• attendance;
• broad demographic information;
• activities delivered;
• progress and outcomes;
• use of funding.
Wherever possible, this information is anonymous or combined so that individuals cannot reasonably be identified.
Coded or pseudonymised information remains personal information where it can be connected back to an individual.
Identifiable information may be shared where necessary for care or support, safeguarding, statutory reporting, eligibility checks, contract monitoring, audit, fraud prevention or complaint investigation.
We only share the minimum information necessary and must have an appropriate lawful basis.
________________________________________
10. Photographs, video, audio and CCTV
We may take or use photographs, video, audio, interviews or creative work for activities, evaluation, funder reports, websites, social media, newsletters, exhibitions, performances or promotional materials.
We will explain how the material may be used and whether participation is optional.
Promotional media consent will normally be separate from consent to receive a service.
Consent can be withdrawn for future use. This may not require AllStar to recall printed materials already distributed or remove completed publications. We will consider reasonable requests to remove online material under our control.
Material published online may be copied or shared by others, and complete removal from third-party platforms cannot be guaranteed.
CCTV
CCTV may be used at designated AllStar premises for security, crime prevention, incident investigation and safeguarding.
Footage is normally retained for 30 days, unless required for an investigation, complaint, insurance claim, safeguarding concern or legal proceedings.
Access is restricted to authorised people. Footage may be shared with police, safeguarding authorities, insurers, courts or legal advisers where necessary and lawful.
________________________________________
11. International transfers
Some cloud, email, website, survey or social-media providers may store or access information outside the UK.
Where a restricted international transfer occurs, we will use an appropriate legal safeguard, such as:
• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses;
• another legally permitted safeguard.
You may ask the Data Protection Lead for further information about relevant transfers and safeguards.
Systems involving international transfers: None at present
________________________________________
12. How long we keep information
We only retain information for as long as necessary.
Retention periods depend on the type of record, the purpose for which it was collected, the relevant contract, safeguarding requirements and legal, insurance or regulatory obligations.
Record type Normal retention period
General enquiries 12 months after closure
Direct referrals and service records Period required by the relevant contract
NHS or commissioned-service records Period required by the relevant contract and record category
Safeguarding records Period stated in AllStar’s retention schedule and applicable guidance
Media-consent records While material remains in use, plus up to six years
CCTV Normally 30 days
Unsuccessful recruitment records Normally six months
Employee records Normally six years after employment ends
Financial records Six years plus the current financial year
Website enquiries 12 months
Records may be kept for longer where necessary for safeguarding, an active complaint, an investigation, insurance or legal proceedings.
When information is no longer needed, it is securely deleted, destroyed or irreversibly anonymised.
AllStar maintains a detailed internal retention schedule.
________________________________________
13. Keeping information safe
We use appropriate measures to protect information from loss, misuse, unauthorised access or disclosure.
These may include:
• secure digital and paper storage;
• restricted access;
• passwords and multi-factor authentication;
• encryption and secure transfer methods;
• backups and cybersecurity controls;
• staff training and confidentiality requirements;
• agreements with service providers.
No electronic system or internet transmission can be guaranteed to be completely secure. Particularly sensitive information should be sent using an agreed secure method.
If a personal-data breach occurs, we will investigate it and notify the Information Commissioner’s Office where legally required. Where a breach creates a high risk to an individual, we will also inform that person unless a lawful exception applies.
________________________________________
14. Your rights
Depending on the circumstances, you may have the right to:
Right What it means
Be informed To understand how your information is used
Access To receive a copy of your information
Rectification To correct inaccurate or incomplete information
Erasure To request deletion in certain circumstances
Restriction To limit how information is used in certain circumstances
Object To object to particular uses
Data portability To receive certain information in a portable format
Withdraw consent To withdraw permission where consent is used
Automated decisions To challenge certain solely automated decisions
Complain To complain to AllStar or the ICO
These rights are not absolute. We may need to keep information for safeguarding, legal or contractual reasons.
Your right to object
Where AllStar relies on legitimate interests or public task, you may object to the use of your information.
We must stop using it unless we can demonstrate compelling legitimate grounds or need it for a legal claim.
You have an absolute right to object to direct marketing.
To exercise any right, contact a member of staff or the Data Protection Lead.
We normally respond within one calendar month. We may ask for reasonable proof of identity.
AllStar does not currently make significant decisions about people using solely automated systems.
________________________________________
15. Additional information for children and young people
Children have data-protection rights in their own name.
There is no fixed minimum age for exercising these rights. We consider whether the child has enough maturity and understanding to:
• understand the request;
• understand the information involved;
• make an informed decision;
• understand any likely consequences.
A parent, carer, advocate or trusted adult may help a child make a request.
Whether information is released to a parent or carer depends on the child’s understanding, parental responsibility, the child’s wishes, best interests, safeguarding concerns and the rights of other people.
Where information concerns another person as well as the child, we may remove or withhold information to protect that person’s privacy.
Making a request or complaint will not affect the support provided by AllStar.
________________________________________
16. Complaints
Concerns about the use of personal information should be directed to:
Data Protection Lead
AllStar
Unit 12, Park View Court
St Paul’s Road
Shipley
BD18 3DZ
Email: dpo@allstarents.co.uk
Telephone: 01274 073604
You may also complain directly to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
You do not have to complete AllStar’s complaints process before contacting the ICO.
________________________________________
17. Cookies and website use
Our website may use cookies and similar technologies for essential functions, security, preferences and website analytics.
Non-essential cookies will only be used where the required permission has been obtained.
Further information can be found on our website under cookie consent.
________________________________________
18. Changes and alternative formats
We may update this notice if the law, our services, systems, suppliers or working practices change.
The latest version will be available on our website and on request. Where a significant change affects how information is used, we will take reasonable steps to inform the people affected.
You may ask for this notice in Easy Read, a larger font, another language, audio format or a shorter child-friendly version.