About this project
Reboot is a programme that supports young people like you who have been in care to help them get good jobs or get into training or education (like school, college or university). Reboot is run by an organisation called 1625 Independent People.
We are an organisation called the Behavioural Insights Team. We are running a project to check how well Reboot works. We want to make sure it works in the best way possible and check whether it can be improved. We will do this by checking if there are any differences between young people who get support from Reboot and young people who receive support from other services.
If you take part in the project you will be put in one of two groups: a group that gets support from Reboot or a group that receives the usual offer of support.
An organisation called the Youth Futures Foundation is paying for the costs of running this project. They are doing this because they carry out work and research that tries to help young people like you who have been in care to get good jobs.
If you take part in our project, we will need to use some of your personal information to carry out the project. This document explains what personal information we will use and what we will do with it.
Who can I contact if I have questions?
We are the data controller of any personal information we collect about you for our project. This means we are responsible for how it is used and for keeping it safe.
We have someone in our organisation called a Data Protection Officer who is responsible for answering any questions you might have about how we use your personal information. You can contact them using these details:
Post: Behavioural Insights Ltd, 58 Victoria Embankment, London, England, EC4Y 0DS
Email: dpo@bi.team
What personal information will we use?
If you take part in our project, we will need to collect some of your personal information from these organisations:
- Your local authority who provides support to you as someone who has been in care
- 1625 Independent People who run Reboot. To find out more about how 1625 Independent People may use your personal information please read their privacy notice at tinyurl.com/1625IP-PN.
- HM Revenue and Customs who deals with the taxes you pay if you are working
- the Department for Education a government department who has information about you on their National Pupil Database from your time at school, training, college or university.
We will collect this type of personal information:
- From 1625 Independent People we will collect:
- the name of your local authority
- your gender
- your postcode
- your date of birth
- your unique pupil number. This is a unique code that most people get when they go to school in England
- If you work we will collect this information from HM Revenues and Customs:
- the name of who you work for
- when you started work
- when you left work
- the number of hours you work
- how much you are paid
- From your local authority we will collect information like:
- a special code created by your local authority to identify you instead of your name
- whether or not you have a job
- whether or not you go to school, college or university
- whether or not you are in an apprenticeship or training programme
- whether you do any of those activities full time or part time
- if you do not do those activities, the reasons for that – for example because you have an illness or have a child to look after
- If you are in the group getting support from Reboot, we will collect information about your taking part in the programme like:
- when you started Reboot
- activities you have taken part in for Reboot
- From the Department for Education we will collect this information which is held on their National Pupil Database:
- your key stage 2 results
- your key stage 4 results
- details about school absences
- your ward. This means your school district
- your ethnicity
- whether or not you have a disability
- To get this information, we will provide the National Pupil Database with this information that we will have received from the organisations listed above:
- your unique pupil number. This is a unique code that most people get when they go to school in England
- your gender
- your date of birth
- information we get from HMRC like your job, who you work form, what you get paid
- information we get from your local authority like whether you have a job or are in school, college or university
If you are not already in touch with them, your local authority or a third party organisation may need to get in contact with you at the end of the evaluation to ask you about your education and employment. Your Local Authority may share your contact details with a third party organisation for this reason.
During or immediately after the study, we may contact you about this research through 1625IP or your local authority. For example, we might invite you to an interview or other research activities related to the project.
Taking part in any additional research is completely voluntary and you can decide not to take part at any time without giving a reason. If you do take part, we will provide you with more information at the time to explain the purpose of the research and how your personal information will be used.
What do we do with your personal information?
We will use your personal information to run the project we have described above in the section called ‘About this project’.
At the end of the project we will write a report setting out what we have learned. The report will not include any personal information so no one will be able to identify you from the report. We will share the report with the Youth Futures Foundation and 1625 Independent People. The report might also be published in a science journal.
What is our legal reason for using your personal information?
In the UK, there are laws about how organisations can use personal information. These include the Data Protection Act 2018 and the UK General Data Protection Regulation. These laws say that organisations must not use personal information unless they have a legal reason to do so. The laws also explain what those legal reasons can be.
The legal reason that we are using your information is “legitimate interests” (as set out in Article 6(1)(f) of the General Data Protection Regulation). This means that we have a legitimate interest in using your personal information to carry out our project to check how well Reboot works and whether it can be improved. This is important work that can help people like you who have been in care get good jobs in the future. We have considered what we are trying to do and what personal information we need. We have carefully thought about your own rights and interests and we do not believe these mean we should not do this project. We cannot carry out the project properly unless we use your personal information in the way we explain in this document.
The law also says we need a special legal reason to use information in our project about your ethnicity and whether or not you have a disability. This is because that information is more sensitive. We collect this information because we want to know if there are any differences in how well Reboot works depending on your ethnicity and whether or not you have a disability. Our special legal reason for using this information is “substantial public interest on the basis of domestic law” (Article 9(2) UK GDPR) and “equality of opportunity or treatment” (Part 2 of Schedule 1 to the DPA).
Who else might have access to your personal information?
We may share your information with the other organisations that are helping us to carry out the project. These are the Youth Futures Foundation, 1625 Independent People, the Department for Education and HM Revenues and Customs.
At the end of the project we may share some of your personal information with the Youth Futures Foundation so they can use it for other important research they do about how they can help young people like you get good jobs. When we share your personal information, we will not share your name but will use a special code instead. For example this means that Youth Futures Foundation will know the personal information belongs to Person 123 but they will not know that Person 123 is you. To find out more about how Youth Futures Foundation may use your personal information please read their privacy notice at tinyurl.com/YFF-PN.
We may sometimes have to share your personal information with:
- Nesta (the company that owns our organisation) or other companies that are owned by Nesta or that we own.
- regulators, law enforcement bodies like the police and the courts, if we need to do this to obey laws and rules that apply to our organisation or help with their investigations;
- other people or companies that help us to run our organisation for example organisations that run our systems or help us store your information. When we use these people or organisations we have contracts with them to make sure they protect your information.
- any organisation that might be interested in buying our company or if we are changing the structure of our organisation or other organisations within our group.
- if we are required to by law, or to protect or defend ourselves or others against illegal or harmful activities.
Will we transfer your information to a foreign country?
The UK has laws that apply when organisations want to use personal information. These laws have strict rules which must be followed if an organisation wants to transfer your personal information outside of the UK.
Because of the way that some of our business systems work, your personal information may be transferred between the UK and the European Economic Area but we will not transfer your information outside of these locations.We comply with all laws that apply when we transfer your data in this way so your information will be protected at all times.
How do we keep your information safe?
We take our responsibility to protect your personal information very seriously. We take measures and follow processes to try to make sure no one can illegally access your personal information, or it cannot be accidentally deleted or sent to anyone else.
Measures that we take include:
- password protection for computers and systems
- locked rooms or cabinets are used for documents or materials containing personal information
- anti-virus protection for computers and systems
- our people who have access to your personal information are trained about how they can use it and how to protect it
- we make sure that access to your personal information is given only to those who need it and that they can no longer access it when they no longer need to.
We also have processes in place so that we can respond quickly if we think that something has gone wrong and our protections for your personal information may be at risk. If that happens we will let you know when the law tells us we have to. We will also let the UK’s regulator for protecting personal information (the Information Commissioner’s Office) know too when the law tells us we have to.
How long will we keep your information for?
We will only keep your personal information for as long as we need to carry out the Project. When the Project has finished we will securely delete your personal information.
When deciding how long we keep personal information for, we look at several things including what the information is, whether it is sensitive and the potential risk of harm from someone else being able to see it. We expect we will delete your personal information two years after we publish our project report. This is expected to be around mid-2028.
Sometimes we might keep your personal information for longer but only in an anonymised way. This means no one will be able to know that the information is about you. We keep information in this way so we can use it for other research projects.
Your legal rights
Your personal information belongs to you. Sometimes, you have specific legal rights including:
- the right to say you do not want your personal information shared with anyone else
- the right to see what personal information has been shared with us and to make sure we are doing what we should with it
- the right to correct mistakes in any personal information
- the right to request that your personal information is deleted by us where there is no good reason for us to keep it (for example, where you do not want your personal information to be shared with us).
If you want to use any of these rights, please get in touch with us using the contact details provided at the start of this document at “Who can I contact if I have questions?”.
Most of the time you will not have to pay anything to use your legal rights. However, we may charge a reasonable fee if your request is not fair, repetitive or excessive. Otherwise, we might not deal with your request in these circumstances.
To be able to help you, we may need information from you so we can confirm who you are. This is to make sure we only share your personal information with you (and not some else’s information).
We try to respond to all proper requests within one month. If it is going to take longer than that we will let you know.
We can only deal with a request to use your rights if we hold information that directly identifies you.
Changes to this document
This document was published on 2 August 2023. We may update it from time to time. If we make any big changes to how we use your personal information we will contact you directly.