Your data

Privacy policy

How we collect, use and protect personal information. Last updated 2 September 2026.

In short: we collect only what we need to run our education programmes safely, we never sell your data, and you can ask us to show you, correct or delete anything we hold at any time by emailingcontact@bridgingthefuture.org.

Introduction

Bridging the Future (“we”, “us”, “our”) is a charity registered in England and Wales, charity number 1201227. We support young refugees, asylum seekers and forced migrants into education through a free summer school at University College London and an online mentoring scheme.

This policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have over it. It applies to students and their parents or guardians, volunteers, donors, partners and visitors to this website. We are the data controller for this information.

Information we collect

We collect only the data we need to deliver our programmes and meet our legal duties.

Applicants and students: name, date of birth or age, contact details, immigration or residency status where it determines eligibility, school or college, subjects studied, English language level, dietary and accessibility requirements, and emergency contact details.
Parents, guardians and social workers: name, relationship to the student, contact details and consent records.
Volunteers: name, contact details, academic and professional background, subjects you can support, availability, and — where a role involves working directly with young people — safeguarding checks and references.
Donors: name, email address, postal address and donation history. Payments are processed by Donorbox; we never see or store your card details.
Website visitors: standard technical data such as IP address, browser type and pages visited, where analytics are in use.
Photographs and media: images and video from our programmes, taken and used only where consent has been given.

Some of this — such as immigration status, or dietary and health requirements — is special category data under the UK GDPR. We collect it only where it is necessary, hold it securely, and restrict access to the smallest number of people who need it.

How we use your information

To assess applications and allocate places on our programmes.
To match students with suitable volunteer mentors.
To run sessions safely, including catering, access and emergency contact.
To communicate with students, families and volunteers about the programmes.
To process donations and issue receipts.
To report anonymised impact figures to funders and in our public reporting.
To improve the website and understand how it is used.
To meet our safeguarding, charity governance and legal obligations.

Our lawful basis for processing

We rely on the following lawful bases under the UK GDPR:

Consent — for photography and media, marketing emails, and processing of special category data where no other basis applies.
Legitimate interests — for running and improving our programmes, volunteer coordination and donor stewardship, balanced against your rights.
Legal obligation — for safeguarding records, Gift Aid and charity reporting.
Vital interests — in an emergency involving a participant’s health or safety.

We do not sell personal data, and we do not share it for third-party marketing. We share it only where necessary:

University College London — minimal participant details required for campus access and room booking while the summer school is running.
Volunteer mentors — the information needed to teach and support their assigned student.
Service providers — for example Donorbox for donation processing, Google for application forms, and our email and hosting providers, each acting under contract on our instructions.
Funders — anonymised, aggregated figures only, unless you have consented to your story being shared.
Authorities — where we are legally required to disclose, or where there is a safeguarding concern.

Young people and safeguarding

Most of the young people we work with are aged 16–22. Where a participant is under 18 we require consent from a parent, guardian or responsible adult before they take part. Safeguarding concerns are recorded and escalated in line with our safeguarding policy, and relevant information may be shared with the appropriate authorities without consent where a young person is at risk.

How long we keep your data

Unsuccessful applications: up to 12 months after the application round closes.
Participant records: for the duration of the programme and up to three years afterwards, so that we can support progression and report on outcomes.
Volunteer records: for the duration of your involvement and up to three years after.
Donation and Gift Aid records: seven years, as required by HMRC.
Safeguarding records: as long as required by law and our safeguarding policy.

Data security

We protect personal data with access controls, encryption in transit, reputable hosted services with their own security programmes, and a policy of collecting the minimum necessary. Access is limited to the volunteers and trustees who need it for their role. No system is completely immune from risk, so please use strong, unique passwords for any accounts you hold with our service providers and tell us immediately if you suspect a breach.

Your rights

Under the UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — have inaccurate or incomplete data corrected.
Erasure — ask us to delete your data, unless we are legally required to keep it.
Restriction — ask us to pause processing while a concern is resolved.
Portability — receive your data in a portable, machine-readable format.
Objection — object to processing based on legitimate interests, and to any direct marketing.
Withdraw consent — at any time, where our processing is based on consent.

To exercise any of these rights, emailcontact@bridgingthefuture.org. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office atico.org.uk.

Cookies and tracking

This website is built as a static site and does not set advertising or profiling cookies. Some pages embed third-party content — the Donorbox donation form on our donate page, and video players — which may set their own cookies when you interact with them. Your browser settings let you block or delete cookies; doing so may limit those embedded features but the rest of the site will continue to work.

Third-party services

Our application forms are hosted on Google Forms, donations are processed by Donorbox, and some video content is hosted on YouTube. When you use those services your data is also handled under their own privacy policies, which we recommend reading. We choose providers that offer appropriate safeguards, but we do not control their platforms.

International data transfers

Some of our service providers process data outside the UK. Where that happens we rely on UK adequacy regulations or Standard Contractual Clauses with the UK International Data Transfer Addendum, so that your data continues to receive an equivalent level of protection.

Changes to this policy

We may update this policy to reflect changes in law, our practices or our services. Any update will be published on this page with a revised date. Please review it from time to time.

Contact us

For any question about this policy or how we handle your data, write tocontact@bridgingthefuture.org.

Registered charity in England and Wales, No. 1201227. Last updated 2 September 2026.