Privacy Policy

Version history: 10 June 2026

Preliminary notice: This is a preliminary privacy policy, published ahead of trueFutures’ formal charity registration. It is subject to change as the organisation develops. The most current version will always be available at truefutures.org.

Introduction

At trueFutures (“we”, “us”, “our”), we are committed to protecting your Personal Data and privacy. This Privacy Notice outlines how and why we collect, use, and store your data, who we share it with, how we keep it secure, and your rights.

“Personal Data” means any information that identifies you as an individual, either directly or indirectly.

By engaging with trueFutures, including signing up as a participant, tutor, or professional, you agree to the practices described in this Privacy Notice. Please also be aware that you may be subject to the privacy policies of third-party service providers we work with (e.g. Brevo, Zoom and Calendly).

Please take time to read this Privacy Notice in full.

Overview

References to “our”, “us”, “we” or “trueFutures” within this Privacy Notice are to trueFutures, a charitable organisation (registration in progress with the Charity Commission of England and Wales).

trueFutures is a UK charity working to support high school students from under-resourced backgrounds by connecting them with university student tutors, and connecting those tutors with working professionals for career guidance.

We are the data controller of your Personal Data under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR).

If you have questions, contact: info@truefutures.org

Who this notice applies to

This notice covers Personal Data relating to:

High school student participants and their parents or guardians
University student volunteers (tutors)
Working professionals
Schools, university societies, and employer partners
Website visitors
Trustees, volunteers, and staff

When we collect your data

We may collect your data:

We may collect your data:
When you sign up as a participant, tutor, or professional
When you apply to volunteer or take part in the programme
Through cookies and analytics on our website
From third parties, such as schools, university societies, or employer partners
When you contact us by email or through our website

Overview

The data we collect depends on your relationship with us.

High school student members
We collect information which may include your name, contact information (address, email and/or telephone number), date of birth, gender, educational details (school, year group, subjects, predicted grades, qualifications attained), personal interests and academic/career aspirations. We may also collect special category data (as defined by applicable data protection laws) from you. This may include information about your ethnic origin, and any disabilities or medical conditions, where you have given explicit consent.

University student members
We collect information which may include your name, contact information, date of birth, gender, educational details (high school, past grades, university, year of study, degree subject, any relevant qualifications attained), personal interests and academic/career aspirations. We may also collect details relating to any work experience or job that you may have had or will have, as well as special category data (such as any free school meal and/or household income data or other data as defined by applicable data protection laws) from you. This may include information about your ethnic origin, and any disabilities or medical conditions, where you have given explicit consent.

Professional members
We collect information which may include your name, contact information and employment information. We may also collect special category data (as defined by applicable data protection laws) from you. This may include information about your ethnic origin, and any disabilities or medical conditions, where you have given explicit consent.

Website users
When you visit our website, we (and our service providers) may use cookies and other technologies to automatically collect the following information:
– Technical information, including your IP address, browser type and version, device identifier, location and time zone setting, operating system, and platform
– Information about your visit, including pages viewed, time spent on pages, and how you navigated the site

Donors
We collect information which may include your name, contact information and employment information

How we use your Personal Data

We use your Personal Data:

To run our tutoring, mentoring, and professional networking programme
To match participants with suitable tutors or professionals
To communicate with you about relevant opportunities
To understand who engages with our work
To support your career development and educational progression
To promote inclusive participation
To conduct research, monitoring, and impact evaluation
To comply with legal obligations

Legal bases for processing

We rely on the following lawful bases:

Legitimate interest – to deliver and improve our services and programmes
Consent – for optional communications, special category data, and research purposes
Contract – where processing is necessary to fulfil an agreement with you
Legal obligation – to meet legal or regulatory requirements

You may withdraw your consent at any time by contacting us at info@truefutures.org.

Who we share your data with

We only share your Personal Data when necessary. Recipients may include:

Other programme participants – for example, sharing a tutor’s name and subject area with the student they are matched with
Schools, university societies, and employer partners – for coordination and evaluation purposes
Service providers – such as IT support, analytics, and email platforms (we use Brevo for our mailing list)
Volunteers or contractors involved in delivering the programme
Strategic partners or funders – where consent is given
Regulatory bodies or law enforcement – where legally required

We only share your Personal Data with third-party platforms and services that have their own published privacy policies and data protection commitments. Where we share personal data with an individual, such as a volunteer or contractor, we ask them in writing to treat it confidentially and use it only for the specific purpose for which it was shared. We encourage you to review the privacy policies of any third-party platforms we use directly.

Schools, university societies, and employer partners as independent controllers

Where you access trueFutures through a school, university society, or employer partner, that organisation may act as an independent data controller in respect of certain personal data they hold about you. In those cases, their own privacy policies will apply to how they handle your data. We encourage you to review those policies directly.

trueFutures is responsible only for the personal data we collect and process directly.

Cross-border transfers of data

Where your data is processed outside of the UK by third-party platforms we use, we use reputable providers who publish their own data transfer compliance documentation. We encourage you to review the privacy policies of those platforms directly.

How we protect your data

We take reasonable steps to protect your Personal Data. At present, trueFutures operates with a small team and the following measures are in place:

Personal data is stored on password-protected platforms, including IONOS (hosting), WordPress, and Brevo (mailing list)
Access to personal data is currently limited to the founder and any individuals directly involved in delivering the programme
We collect only the data necessary for the purposes described in this policy

As the organisation grows, we will develop and formalise additional security procedures, including access controls, data handling protocols, and a breach response process.

However, no system is completely secure. We cannot guarantee protection from cyberattacks or data breaches, though we take every reasonable step to minimise risks.

Data retention

We retain your Personal Data in line with the following schedule:

Participant contact details – duration of participation plus 2 years
Programme records (including but not limited to records of which students were matched with which tutors, which tutors matched with which professionals, session logs or attendance records, feedback or ratings submitted after sessions, notes on participant progress, correspondence related to specific matches or sessions) – 6 years after the programme ends
Financial records – 7 years (HMRC requirement)
Safeguarding records – until the child turns 25, or 7 years after the incident, whichever is longer
Unsuccessful university volunteer applications – 6 months
Website analytics – 26 months
Email correspondence – 3 years

Children and young people

Some of our services involve participants under the age of 18. We take the privacy and safety of young people seriously and aim to handle their personal data with particular care.

Where a participant is under 18, we will seek consent from a parent or guardian before collecting or processing their personal data. We commit to the following in respect of under-18 participants:

We collect only the data strictly necessary to deliver the programme
We do not use their data for any secondary purpose, such as marketing or research, without separate explicit consent
We do not share their data with third parties beyond what is necessary to deliver the service
Any communications or forms directed at them are written in clear, age-appropriate language
They may withdraw from the programme at any time and request deletion of their data
We do not make participation conditional on providing more data than is necessary

We do not knowingly collect personal data from children under 13. As the organisation develops, we intend to align our approach with the ICO’s Age Appropriate Design Code (the Children’s Code).

Use of AI tools

We may use third-party AI-powered tools to support the delivery of our services, such as matching participants or improving communications. Where AI tools process your personal data, this is done in accordance with this policy and any applicable data processing agreements that those providers have.

The underlying AI models used by these tools are general-purpose models developed and trained by third-party providers on their own data. They are not trained on your personal data. Your data is processed at the point of use only, in order to generate a response or output.

We will update this section as our use of AI tools develops.

Your rights

By law, you have the following rights in relation to your Personal Data. To exercise any of these rights, please contact us and we will respond in accordance with applicable laws.

Right to information – the right to be informed about how we collect and use your Personal Data
Right of access – the right to request a copy of the Personal Data we hold about you
Right to rectification – the right to have inaccurate or incomplete data corrected
Right to be forgotten – the right to request erasure of your Personal Data where it is no longer required
Right to restrict processing – the right to ask us to limit how we use your data
Right to object – the right to object to how we process your Personal Data
Right to data portability – the right to receive your data in a portable, reusable format
Right to withdraw consent – the right to withdraw consent at any time, without affecting prior processing
Automated decision-making – the right not to be subject to decisions based solely on automated processing, including profiling
Right to complain – the right to lodge a complaint with the ICO

Use of cookies

Cookies are small files stored on your device when you visit a website. We may use cookies to personalise content, analyse site usage, and enhance user experience. By using our site you are consenting to our use of these cookies. To change your cookie preferences, please use the cookie banner on our website.

Analytics and log data

We may use tools such as Google Analytics to monitor traffic and user behaviour on our website. This helps us improve functionality and user experience. Log data includes IP address, browser type, session length, and pages visited. This is anonymised where possible and used in aggregate form.

Third-party links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party sites. We encourage you to review their policies before submitting any personal data.

Changes to this Notice

We review this policy at least annually. In the event of revising this Privacy Policy, we will post the updates on our website and, where appropriate, notify registered participants by email.

Contact

Email: info@truefutures.org
Website: truefutures.org