The Hubb Foundation’s Privacy Policy
Last updated: February 2026
The Hubb Foundation (“we”, “us”, “our”) is committed to being transparent about how we collect, use, store, and share personal information. This Privacy Policy explains how we handle personal data when delivering activities, services, and programmes for children, young people, families, volunteers, staff, and partners.
Our aim is to provide clear information so you can understand how and why your data is used, in line with UK GDPR and good practice models used across the sector.
1. Who we are
The Hubb Foundation is a registered charity working with delivery organisations, activity providers, community groups, and other partners to deliver school‑holiday activities and support services.
For activities and services we commission, we act as the Data Controller, determining the purposes and means of processing personal data—even when information is collected using systems or processes operated by our delivery partners.
2. What personal data we collect
We collect and process a broad range of personal data depending on how you interact with us and the activities or services you take part in. The types of information we handle will vary depending on the programme, activity, or funding requirements, and may include, but are not limited to, general personal details, information needed to help us understand eligibility for programmes, and details required to support safe participation, effective communication, and good safeguarding practice.
This may include:
Basic personal details such as names, contact information, and demographic information.
Information relating to participation in our programmes or activities, such as registrations, attendance, engagement, or support needs.
Information shared with us for organisational or administrative purposes, such as employment or volunteering details, supplier or provider contact information, or payment/expense information where relevant.
Information that helps us to meet safeguarding, safety, or wellbeing duties, which may include limited health‑related or vulnerability‑related information where required to protect individuals and support their safe involvement in our services.
Technical or website‑related information, such as IP addresses or browser details, collected when you use our website.
Special category data: We may process special category data (for example health‑related information or safeguarding‑related information) only where it is necessary and proportionate, and only where we have a lawful basis and an additional condition under UK GDPR—such as safeguarding individuals at risk, vital interests, or substantial public interest. We apply enhanced protections to this type of information.
3. How we collect your information
We collect personal information in several ways:
When you register for or attend an activity or programme
Through paper or electronic forms
When you email, call, message us, or submit an enquiry via our website
When engaging with delivery partners commissioned by The Hubb Foundation
We may also receive information directly from delivery providers acting on our behalf, including when they use their own approved systems or processes to register participants or manage attendance. Providers must share information securely in line with our Data Processing Agreements.
3a. Use of third-party and provider booking systems
Where appropriate, The Hubb Foundation may authorise commissioned service providers to use their own or third-party systems or processes to collect personal information on our behalf.
This may include digital platforms, manual registration processes, or a combination of both, provided they meet our data protection and security requirements.
In these cases, service providers are required to:
• comply with UK GDPR and applicable data protection legislation;
• provide clear and accessible privacy information to parents and carers at the point of data collection; and
• share required personal information with The Hubb Foundation securely and within agreed timescales.
The Hubb Foundation remains the Data Controller for personal data processed for activities it commissions, and service providers act as Data Processors under our instruction.
4. Where your data may come from
You, your child, or your household
Our delivery partners and commissioned providers
Schools or local authorities where appropriate and lawful
Volunteering or job applications
Website usage and analytics
5. How we use your information
We use personal information to:
Deliver and manage activities and services
Safeguard children, young people, and vulnerable adults
Communicate with participants, parents/carers, volunteers, and partners
Monitor attendance, outcomes, and programme performance
Meet funder, contractual, and reporting requirements
Improve and develop our services
Comply with legal and regulatory obligations
We do not use personal data for automated decision‑making or profiling.
6. Lawful basis for processing
We rely on one or more of the following lawful bases:
Public task – delivering commissioned programmes (such as HAF)
Legitimate interests – delivering and improving our services
Contract – managing relationships with staff, volunteers, and providers
Legal obligation – safeguarding, employment law, and compliance
Consent – for optional communications or photography
Vital interests – where necessary to protect life
7. Sharing your information
We may share your information with:
Commissioned delivery partners and activity providers
Local authorities, government departments, or funders where required
Professional advisers, auditors, or insurers
Emergency services or safeguarding agencies where necessary
Regulators such as the Information Commissioner’s Office (ICO)
We do not sell or lease personal data.
8. Data security
We take appropriate technical and organisational measures to protect your data, including secure systems, restricted access, encryption, and staff/provider training. Delivery partners acting on our behalf must implement and maintain equivalent security measures.
9. Data retention
We keep personal information only for as long as necessary for the purpose it was collected, including safeguarding, contractual, and legal obligations.
10. Your rights
Under UK data protection law, you have the right to:
Access your personal information
Request correction of inaccurate information
Request erasure in specific circumstances
Object to or request restriction processing
Request data portability
Withdraw consent where processing is based on consent
11. Subject Access Requests and complaints
You can make a request regarding your personal data or raise any concerns by contacting our Data Protection Officer:
You also have the right to raise concerns with the Information Commissioner’s Office (ICO) at www.ico.org.uk.
If you wish to raise a concern about how we handle your personal data, please refer to The Hubb Foundation’s Complaints Policy, which outlines the process for submitting and escalating a complaint.
12. Photographs and video recordings
We may take photographs or video recordings during activities. Where individuals can be identified, we obtain appropriate consent and ensure images are used fairly and lawfully.
13. Vulnerable individuals
We recognise the vulnerability of some individuals and may work with a parent, carer, or third‑party representative to ensure privacy is respected and protected.
14. How to contact us
The Hubb Foundation
Email: info@thehubbfoundation.org.uk
Website: www.thehubbfoundation.com
Telephone: 01782 656050
Address: The Whitehouse, 566 Etruria Road, ST5 0SU
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. Any changes will be published on our website with an updated revision date.
Document Information
Document Owner: Board of Directors
Effective Date: 24/05/2019
Last Reviewed Date: 30/01/2026
Next Review Date: 30/01/2027
