About this project
Reboot is a programme that supports young people like you who have been in care to help them get good jobs or get into training or education (like school, college or university). Reboot is run by an organisation called 1625 Independent People.
We are an organisation called the Behavioural Insights Team. We are running a project to check how well Reboot works. We want to make sure it works in the best way possible and check whether it can be improved. We will do this by checking if there are any differences between young people who get support from Reboot and young people who receive support from other services.
If you take part in the project you will be put in one of two groups: a group that gets support from Reboot or a group that receives the usual offer of support.
An organisation called the Youth Futures Foundation is paying for the costs of running this project. They are doing this because they carry out work and research that tries to help young people like you who have been in care to get good jobs.
If you take part in our project, we will need to use some of your personal information to carry out the project. This document explains what personal information we will use and what we will do with it.
Who can I contact if I have questions?
We are the data controller of any personal information we collect about you for our project. This means we are responsible for how it is used and for keeping it safe.
We have someone in our organisation called a Data Protection Officer who is responsible for answering any questions you might have about how we use your personal information. You can contact them using these details:
Post: Behavioural Insights Ltd, 58 Victoria Embankment, London, England, EC4Y 0DS
Email: [email protected]
What personal information will we use?
If you take part in our project, we will need to collect some of your personal information from these organisations:
- Your local authority who provides support to you as someone who has been in care
- 1625 Independent People who run Reboot. To find out more about how 1625 Independent People may use your personal information please read their privacy notice at tinyurl.com/1625IP-PN.
- HM Revenue and Customs who deals with the taxes you pay if you are working
- the Department for Education a government department who has information about you on their National Pupil Database from your time at school, training, college or university.
We will collect this type of personal information:
- From 1625 Independent People we will collect:
- the name of your local authority
- your gender
- your postcode
- your date of birth
- your unique pupil number. This is a unique code that most people get when they go to school in England
- If you work we will collect this information from HM Revenues and Customs:
- the name of who you work for
- when you started work
- when you left work
- the number of hours you work
- how much you are paid
- From your local authority we will collect information like:
- a special code created by your local authority to identify you instead of your name
- your national insurance number
- whether or not you have a job
- whether or not you go to school, college or university
- whether or not you are in an apprenticeship or training programme
- whether you do any of those activities full time or part time
- if you do not do those activities, the reasons for that – for example because you have an illness or have a child to look after
- If you are in the group getting support from Reboot, we will collect information about your taking part in the programme like:
- when you started Reboot
- activities you have taken part in for Reboot
- Information about any additional assistance required (e.g. any language barriers and measures we put in place to assist)
- details about other support you may have received while taking part in the Reboot programme
- wellbeing data (which may include health data)
- From the Department for Education we will collect this information which is held on their National Pupil Database:
- your key stage 2 results
- your key stage 4 results
- details about school absences
- your ward. This means your school district
- your ethnicity
- whether or not you have a disability
- To get this information, we will provide the National Pupil Database with this information that we will have received from the organisations listed above:
- your unique pupil number. This is a unique code that most people get when they go to school in England
- your gender
- your date of birth
- information we get from HMRC like your job, who you work for, what you get paid
- information we get from your local authority like whether you have a job or are in school, college or university
If you are not already in touch with them, your local authority or a third party organisation may need to get in contact with you at the end of the evaluation to ask you about your education and employment. Your Local Authority may share your contact details with a third party organisation for this reason.
During or immediately after the study, we may contact you about this research through 1625IP or your local authority. For example, we might invite you to an interview or other research activities related to the project.
Taking part in any additional research is completely voluntary and you can decide not to take part at any time without giving a reason. If you do take part, we will provide you with more information at the time to explain the purpose of the research and how your personal information will be used.
June 2025 update – changes to information processed and collection methods
Following some updates to data sharing processes for the evaluation, we will also now be collecting/sharing the following additional information:
- From your local authority we will be collecting:
- Your full name – this will help us ensure we can find your information in the Department for Education’s National Pupil Database
- Your date of birth
- Whether or not you are an unaccompanied asylum seeking child (UASC) – this will help us understand whether Reboot works for different types of young people
- With the National Pupil Database we will be sharing your full name – this is necessary to ensure that we are able to correctly match our data with the data that they already hold about you.
We mentioned that a third party organisation may need to contact you at the end of the evaluation to ask about your education and employment. This organisation is named BMG Research Ltd.
To ensure that BMG Research can contact you, your local authority will share the following information with them:
- Your full name
- Your data of birth
- The name of the local authority responsible for your care
- The name of your allocated personal advisor/PA (if you have one) – this is to help demonstrate that the contact from BMG is not a spam call
- A special code created by your local authority to identify you instead of your name
- Your contact details, such as your phone number and email address
When BMG Research contact you, they will ask you for the following information which they will pass onto us so that we can see how well Reboot works:
- whether or not you have a job
- whether or not you go to school, college or university
- whether or not you are in an apprenticeship or training programme
- whether you do any of those activities full time or part time
How will BMG Research handle your information?
BMG Research Ltd is helping us to contact young people as part of this project. This means they are acting as a data processor, which means they are only allowed to use your personal information in the ways that we tell them to.
How your data will be stored
BMG Research will store your personal information on secure systems located in the UK. These systems are protected by technical and organisational measures such as encryption, strong access controls, and secure network configurations.
Who can access your data
Only trained staff at BMG Research who need to see your personal information to carry out the project will be able to access it. Their access is strictly limited and monitored. All staff are required to complete data protection training and follow strict confidentiality agreements.
How your data will be used
BMG Research will only use your information to contact you for the purposes of this project (such as asking about your education, training or employment and to respond to any questions or feedback you might raise). They will pass this information back to the Behavioural Insights Team in a secure way. They will not use your personal information for any other reason.
When your data will be deleted
BMG Research will securely delete all personal information relating to this project within 6 months of completing their part of the work. They will confirm to us when this deletion has taken place. Please be aware that the Behavioural Insights Team will retain your personal information for a longer period – please see the “How long will we keep your information for?” section below.
Keeping your data safe
We have a contract in place with BMG Research that requires them to keep your data safe and only use it in the ways we’ve described. This contract ensures that BMG Research follows all UK data protection laws (including the UK GDPR and Data Protection Act 2018).
What do we do with your personal information?
We will use your personal information to run the project we have described above in the section called ‘About this project’.
At the end of the project we will write a report setting out what we have learned. The report will not include any personal information so no one will be able to identify you from the report. We will share the report with the Youth Futures Foundation and 1625 Independent People. The report might also be published in a science journal.
What is our legal reason for using your personal information?
In the UK, there are laws about how organisations can use personal information. These include the Data Protection Act 2018 and the UK General Data Protection Regulation. These laws say that organisations must not use personal information unless they have a legal reason to do so. The laws also explain what those legal reasons can be.
The legal reason that we are using your information is “legitimate interests” (as set out in Article 6(1)(f) of the General Data Protection Regulation). This means that we have a legitimate interest in using your personal information to carry out our project to check how well Reboot works and whether it can be improved. This is important work that can help people like you who have been in care get good jobs in the future. We have considered what we are trying to do and what personal information we need. We have carefully thought about your own rights and interests and we do not believe these mean we should not do this project. We cannot carry out the project properly unless we use your personal information in the way we explain in this document.
The law also says we need a special legal reason to use information in our project about your ethnicity and whether or not you have a disability. This is because that information is more sensitive. We collect this information because we want to know if there are any differences in how well Reboot works depending on your ethnicity and whether or not you have a disability. Our special legal reason for using this information is “substantial public interest on the basis of domestic law” (Article 9(2) UK GDPR) and “equality of opportunity or treatment” (Part 2 of Schedule 1 to the DPA).
Who else might have access to your personal information?
We may share your information with the other organisations that are helping us to carry out the project. These are the Youth Futures Foundation, 1625 Independent People, the Department for Education and HM Revenues and Customs.
At the end of the project we may share some of your personal information with the Youth Futures Foundation so they can use it for other important research they do about how they can help young people like you get good jobs. When we share your personal information, we will not share your name but will use a special code instead. For example this means that Youth Futures Foundation will know the personal information belongs to Person 123 but they will not know that Person 123 is you. To find out more about how Youth Futures Foundation may use your personal information please read their privacy notice at tinyurl.com/YFF-PN.
We may sometimes have to share your personal information with:
- Nesta (the company that owns our organisation) or other companies that are owned by Nesta or that we own.
- regulators, law enforcement bodies like the police and the courts, if we need to do this to obey laws and rules that apply to our organisation or help with their investigations;
- other people or companies that help us to run our organisation for example organisations that run our systems or help us store your information. When we use these people or organisations we have contracts with them to make sure they protect your information.
- any organisation that might be interested in buying our company or if we are changing the structure of our organisation or other organisations within our group.
- if we are required to by law, or to protect or defend ourselves or others against illegal or harmful activities.
Will we transfer your information to a foreign country?
The UK has laws that apply when organisations want to use personal information. These laws have strict rules which must be followed if an organisation wants to transfer your personal information outside of the UK.
Because of the way that some of our business systems work, your personal information may be transferred between the UK and the European Economic Area but we will not transfer your information outside of these locations.We comply with all laws that apply when we transfer your data in this way so your information will be protected at all times.
How do we keep your information safe?
We take our responsibility to protect your personal information very seriously. We take measures and follow processes to try to make sure no one can illegally access your personal information, or it cannot be accidentally deleted or sent to anyone else.
Measures that we take include:
- password protection for computers and systems
- locked rooms or cabinets are used for documents or materials containing personal information
- anti-virus protection for computers and systems
- our people who have access to your personal information are trained about how they can use it and how to protect it
- we make sure that access to your personal information is given only to those who need it and that they can no longer access it when they no longer need to.
We also have processes in place so that we can respond quickly if we think that something has gone wrong and our protections for your personal information may be at risk. If that happens we will let you know when the law tells us we have to. We will also let the UK’s regulator for protecting personal information (the Information Commissioner’s Office) know too when the law tells us we have to.
How long will we keep your information for?
We will only keep your personal information for as long as we need to carry out the Project. When the Project has finished we will securely delete your personal information.
When deciding how long we keep personal information for, we look at several things including what the information is, whether it is sensitive and the potential risk of harm from someone else being able to see it. We expect we will delete your personal information two years after we publish our project report. This is expected to be around mid-2028.
Sometimes we might keep your personal information for longer but only in an anonymised way. This means no one will be able to know that the information is about you. We keep information in this way so we can use it for other research projects.
Your legal rights
Your personal information belongs to you. Sometimes, you have specific legal rights including:
- the right to say you do not want your personal information shared with anyone else
- the right to see what personal information has been shared with us and to make sure we are doing what we should with it
- the right to correct mistakes in any personal information
- the right to request that your personal information is deleted by us where there is no good reason for us to keep it (for example, where you do not want your personal information to be shared with us)
- You also have the right to object to the way we process your personal information. This means that you can tell us if you do not agree with how we are using your data. If you raise an objection, we will review this and, unless we can demonstrate compelling reasons for continuing the processing or if the processing is necessary for a contractual or legal obligation, we will stop processing your personal information for those purposes.
If you want to use any of these rights, please get in touch with us using the contact details provided at the start of this document at “Who can I contact if I have questions?”.
Most of the time you will not have to pay anything to use your legal rights. However, we may charge a reasonable fee if your request is not fair, repetitive or excessive. Otherwise, we might not deal with your request in these circumstances.
To be able to help you, we may need information from you so we can confirm who you are. This is to make sure we only share your personal information with you (and not some else’s information).
We try to respond to all proper requests within one month. If it is going to take longer than that we will let you know.
We can only deal with a request to use your rights if we hold information that directly identifies you.
Changes to this document
This document was published on 12 June 2025. We may update it from time to time. If we make any big changes to how we use your personal information we will contact you directly.