Privacy Notice

1. About This Privacy Notice

This Privacy Notice explains how Supreme Mentoring Services collects, uses, shares, retains and protects personal information about the people it works with, including young people, parents and carers, school contacts, partner organisations, website visitors and job applicants.

Please read this notice carefully. If you have any questions, contact us using the details in Section 25.

2. Who We Are

Supreme Mentoring Services is operated by Taj Reid as a sole trader, providing mentoring, wellbeing and educational support services to young people, schools and families in Birmingham and the surrounding area.

3. Who This Notice Applies To

This notice applies to:

• Young people who receive mentoring or support from Supreme Mentoring Services;
• Parents, carers and family members of those young people;
• School staff, designated safeguarding leads and other school contacts;
• Staff and volunteers at partner organisations;
• People who contact us through our website, by telephone or by email;
• Job applicants and people who express an interest in working with us.

Where Supreme Mentoring Services processes personal information on behalf of a school or partner organisation as a data processor, the school or partner organisation is the data controller and its own privacy notice will also apply.

4. Information We Collect

Depending on the nature of our relationship with you, we may collect:

Young people and families

• Full name, date of birth, gender and contact details;
• School name, year group and attendance records;
• Educational history, EHCP details and SEMH information;
• Family background and household circumstances (where relevant to the support provided);
• SHINE assessment scores and progress records;
• Mentoring session notes and outcome summaries;
• Safeguarding information, including disclosures and referral records;
• Special-category information (see Section 8).

Website visitors and enquirers

• Name, email address and telephone number submitted through contact forms;
• The content of your enquiry or message;
• Technical information collected automatically (see Section 16).

Job applicants

• Name, contact details and employment history;
• Qualifications, references and right-to-work information;
• DBS disclosure information (see Section 8).

School and partner contacts

• Name, job title, school or organisation name and work contact details.

5. How We Collect Information

We collect personal information:

• Directly from you or your parent or carer when you contact us, complete a form or enrol in a programme;
• From schools or partner organisations that commission our services or refer a young person to us;
• Through our website contact and enquiry forms;
• During mentoring sessions, assessments and reviews;
• From third parties such as local authorities, social care teams or health professionals, where this is necessary for safeguarding or service delivery;
• Automatically through cookies and similar technologies when you visit our website (see Section 16).

6. Why We Use Information

We use personal information to:

• Deliver mentoring, wellbeing and educational support services;
• Carry out SHINE assessments and track progress;
• Communicate with young people, parents, carers and schools about programmes and appointments;
• Fulfil our safeguarding obligations and protect the welfare of children and young people;
• Manage referrals and coordinate with schools and partner organisations;
• Respond to enquiries submitted through our website or by other means;
• Manage recruitment and assess job applications;
• Maintain records required for the safe and effective delivery of our services;
• Comply with our legal obligations.

7. Our Lawful Bases

Under UK GDPR, we must have a lawful basis for processing personal information. The lawful bases we rely on are:

• Contract: where processing is necessary to deliver a service you or your school have requested;
• Legal obligation: where we are required to process information to comply with a legal duty, including safeguarding obligations;
• Legitimate interests: where processing is necessary for our legitimate interests in running and improving our services, provided those interests are not overridden by your rights and interests;
• Vital interests: where processing is necessary to protect someone's life;
• Consent: where we have asked for and received your consent, for example for marketing communications or the use of photographs. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where we process special-category information, we rely on the additional conditions set out in Section 8.

8. Special-Category Information

Some information we process is special-category information under the UK GDPR. This may include information concerning health, mental health, disability, special educational needs, racial or ethnic origin, religious or philosophical beliefs and other particularly sensitive characteristics.

Criminal-offence information is not special-category information, but it is subject to separate additional protections under UK data-protection legislation.

Health, mental health and SEMH information

We process relevant special-category information where it is necessary and proportionate to provide appropriate mentoring support. Depending on the circumstances, we may rely on explicit consent, the establishment or defence of legal claims, vital interests, or substantial public interest conditions — including safeguarding children and individuals at risk — where the relevant legal requirements are satisfied.

Criminal-offence and DBS information

We process DBS disclosure information for staff, volunteers and contractors to comply with our safeguarding obligations and to protect the young people we work with. DBS information is handled in accordance with the DBS Code of Practice. We do not retain DBS certificate numbers beyond the period necessary for safer-recruitment purposes.

Where a young person's background includes involvement with the criminal justice system, we may process relevant information to the extent necessary to deliver appropriate support and to fulfil our safeguarding duties.

9. Children and Young People

The majority of the people we work with are children and young people under the age of 18. We take particular care when processing their personal information.

Where consent is the appropriate lawful basis, we will ensure that it is valid and provided by a person capable of giving it. The specific UK GDPR rules concerning parental authorisation for children under 13 apply where an online service is offered directly to a child and consent is relied upon. These rules do not apply to every use of a child's information. For most mentoring, safeguarding and school-commissioned activities, another lawful basis may be more appropriate.

We do not use the personal information of children and young people for marketing purposes.

Young people have the same information rights as adults (see Section 20), subject to their capacity to exercise those rights. Where a young person lacks capacity, a parent, carer or other appropriate person may exercise rights on their behalf.

10. Safeguarding and Confidentiality

Supreme Mentoring Services takes its safeguarding responsibilities seriously. We operate a confidential service, but confidentiality is not absolute.

We will share information without consent where we believe a child or young person is at risk of significant harm, where we are required to do so by law, or where there is a serious risk to the life of any person.

Where we share safeguarding information, we will do so only with the appropriate authorities, including the local authority designated officer (LADO), children's social care, the police or other statutory agencies, and only to the extent necessary.

We will tell young people and their families about the limits of confidentiality at the start of our work together, unless doing so would put someone at risk.

11. Schools and Partner Organisations

When SMS acts as a data controller

Where Supreme Mentoring Services determines the purposes and means of processing personal information independently — for example, when delivering private mentoring commissioned directly by a family — we act as the data controller and this notice applies in full.

When SMS acts as a data processor

Where a school or partner organisation commissions Supreme Mentoring Services to deliver a programme and provides us with personal information about pupils or service users, the school or partner organisation is the data controller. In that case, we process personal information only on the instructions of the controller and in accordance with a written data-processing agreement.

Schools and partner organisations should refer to their own privacy notices for information about how they process personal data relating to pupils and families.

12. Who We Share Information With

We may share personal information with:

• Schools and educational settings that have commissioned our services or referred a young person to us;
• Parents and carers, where appropriate and in the best interests of the young person;
• Local authorities, children's social care teams and other statutory agencies, where required for safeguarding or legal compliance;
• The police or other law-enforcement agencies, where required by law or to prevent or detect crime;
• Partner organisations involved in delivering a programme, subject to appropriate data-sharing agreements;
• Authorised mentors, workers and contractors involved in delivering our services;
• Website hosting and website-management providers;
• Email, cloud-storage, communication and online-form providers;
• DBS, safer-recruitment and compliance providers;
• Accountants, insurers and legal advisers;
• Payment and accounting providers.

Service providers acting on our behalf are expected to process personal information only for authorised purposes and to apply appropriate confidentiality and security measures.

We do not sell personal information to third parties. We do not share personal information for commercial marketing purposes.

13. International Transfers

Some of our website, email, cloud-storage, form or technology providers may store or access personal information outside the United Kingdom. Where an international transfer takes place, we will ensure that an appropriate legal transfer mechanism and relevant safeguards apply.

If we use any service or tool that transfers personal information outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the UK International Data Transfer Agreement or an adequacy decision.

14. How Long We Keep Information

We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

Our usual retention approach is:

• Website enquiries that do not lead to a service: normally retained for up to 12 months after the last meaningful contact;
• Unsuccessful recruitment applications: normally retained for six months after the recruitment decision, unless the applicant agrees to a longer talent-pool period;
• Business and contractual records: normally retained for up to six years after the relationship or transaction ends;
• Financial and taxation records: retained for the period required by HM Revenue & Customs and applicable accounting requirements;
• Information processed on behalf of a school or partner: retained or deleted according to the data controller's documented instructions and contractual requirements;
• Mentoring, SHINE and outcome records controlled by Supreme Mentoring Services: retained according to our documented retention schedule, taking account of the young person's age, safeguarding requirements, the nature of the service, contractual obligations and applicable legal limitation periods;
• Safeguarding records: retained according to applicable safeguarding guidance, the nature and seriousness of the concern, commissioning arrangements and legal or professional requirements. Safeguarding records may need to be kept longer than ordinary mentoring records;
• Complaints and incident records: normally retained for up to six years after closure, or longer where safeguarding, litigation or another legal requirement applies.

When personal information is no longer needed, it is securely deleted or destroyed.

15. How We Protect Information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction or alteration. These measures include:

• Restricting access to personal information to those who need it to carry out their role;
• Using password protection and, where appropriate, encryption for electronic records;
• Storing physical records securely;
• Ensuring that staff and volunteers understand their data-protection obligations.

No method of transmission over the internet or electronic storage is entirely secure. We take reasonable steps to protect personal information but cannot guarantee absolute security.

16. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a website.

We use strictly necessary cookies to make the website function. These do not require your consent.

We will only use non-essential cookies — such as analytics or performance cookies — if you have given your consent through our cookie consent banner. The publication of this Privacy Notice does not constitute consent to the use of non-essential cookies.

You can review or change your cookie preferences at any time using the button below. This will reopen the cookie consent banner so you can make a new choice.

You can also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

17. Marketing Communications

We will only send you marketing communications if you have given your explicit consent to receive them.

Submitting an enquiry through our website or applying for a role does not automatically subscribe you to marketing communications.

You may withdraw your consent to receive marketing communications at any time by contacting us at [email protected].

18. Photographs, Testimonials and Case Studies

We may use photographs, testimonials or anonymised case studies on our website or in our promotional materials to illustrate the work we do.

We will only use identifiable photographs or named testimonials with the explicit consent of the individual concerned, or, where the individual is under 18, with the consent of a parent or carer.

Case studies used on our website or in our materials are anonymised unless the individual has given explicit consent to be identified.

You may withdraw your consent for us to use your photograph, testimonial or case study at any time by contacting us. We will remove the content as soon as reasonably practicable.

19. Automated Decision-Making

Supreme Mentoring Services does not make decisions about individuals solely by automated means that produce legal or similarly significant effects.

SHINE assessments are completed and reviewed by appropriately trained mentors and involve professional judgement. Assessment scores are used to inform, not replace, professional decision-making.

20. Your Information Rights

Under UK GDPR, you have the following rights in relation to your personal information:

• Right of access: you may request a copy of the personal information we hold about you;
• Right to rectification: you may ask us to correct inaccurate or incomplete information;
• Right to erasure: you may ask us to delete your personal information in certain circumstances;
• Right to restriction: you may ask us to restrict the processing of your information in certain circumstances;
• Right to data portability: where processing is based on consent or contract and carried out by automated means, you may ask us to provide your information in a structured, commonly used and machine-readable format;
• Right to object: you may object to processing based on legitimate interests or carried out for direct marketing purposes;
• Rights related to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these rights, please contact us using the details in Section 25. We will respond within one month. We may need to verify your identity before processing your request.

Some rights are not absolute and may be subject to exemptions. We will explain any applicable exemptions when we respond to your request.

21. Data-Protection Complaints

If you have a concern about how we have collected, used, shared, retained or protected your personal information, please contact us at [email protected] using the subject line 'Data Protection Complaint'.

We will:

• provide a clear way for you to raise a complaint;
• acknowledge your complaint within 30 days;
• take appropriate steps to investigate the matter;
• keep you appropriately informed about its progress; and
• communicate the outcome without undue delay.

A data-protection complaint is separate from a request to exercise an information right, although both may be submitted at the same time. You also have the right to complain to the Information Commissioner's Office.

22. Complaining to the ICO

The Information Commissioner's Office (ICO) is the UK's independent supervisory authority for data protection. You have the right to lodge a complaint with the ICO if you believe we have not handled your personal information in accordance with UK GDPR.

ICO website: www.ico.org.uk

ICO helpline: 0303 123 1113

You may raise a complaint with the ICO at any time. We would nevertheless welcome the opportunity to understand and address your concern directly where you feel able to contact us.

23. Links to Other Websites

Our website may contain links to other websites. This Privacy Notice applies only to the Supreme Mentoring Services website. We are not responsible for the privacy practices of other websites and encourage you to read their privacy notices.

24. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, services or legal obligations. The effective date and last-reviewed date at the top of this page will be updated whenever we make a material change.

We encourage you to review this notice periodically. Where changes are significant, we will take reasonable steps to bring them to your attention.

25. Contact Us

If you have any questions about this Privacy Notice, wish to exercise your information rights, or have a concern about how we have handled your personal information, please contact: