Privacy Policy

Please read this Privacy Policy carefully and check it occasionally as it could change from time to time. This Privacy Policy adheres to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

BulliesOut Privacy Promise

BulliesOut are dedicated to safeguarding your privacy online in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We use your personal information to support and develop our connection with you. We do not sell your personal data. We may share your data with trusted third-party service providers who support our operations, and where required by law or for safeguarding purposes. You may contact BulliesOut at any time with any privacy queries or concerns and to see the personal data you have given us and request modification.

Where we collect data relating to children, we ensure appropriate consent is obtained from a parent or guardian where required.

Personal data means any information relating to an identified or identifiable natural person. This can include name, email address, address and much more.

Your Information

When you engage with our services, we ask for data such as your name, e-mail address, billing address and contact details. BulliesOut keeps a record of this information for tax purposes and for ensuring we fulfil our contract with you.

The only personal information we hold is what clients provide to us when they are a volunteer, purchase merchandise, sign up for the newsletter or otherwise engage in our services.

We may need to share data with child protection if we feel there are issues – this is covered extensively in our Safeguarding Policy.

Data is stored on relevant systems such as cloud systems, HubSpot CRM, Mailchimp, DropBox, Google products, WordPress and accounting systems which are UK GDPR compliant. In limited circumstances, we may also process such data where necessary for safeguarding purposes. An example of this would be if HMRC requested an audit.

Some of our service providers may transfer data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations or Standard Contractual Clauses.

We retain personal data only for as long as necessary for the purposes for which it was collected, including programme delivery, safeguarding, and legal obligations. Email addresses provided for marketing are stored until they are no longer relevant for the purpose collected. Staff and Trustee information is destroyed after 6 years, Volunteer and Youth Ambassador information s kept up to 12 months following departure, unless a longer retention period is required for safeguarding or legal obligations. Information required for tax and legal requirements are held for 7 years as a requirement by law.

When you engage the services of BulliesOut you will be asked whether you’d like to consent to us displaying your order as part of our marketing materials by signing a media release form. By giving your consent for us to do this you understand your personal data will be in the public domain and we will take reasonable steps to remove content where consent is withdrawn; however, we cannot control further use of information already in the public domain.

Special Category Data

In some circumstances, particularly in relation to our Youth Ambassador programme, BulliesOut may collect and process special category data as defined under the UK GDPR. This may include:

• Health information (e.g. allergies or medical requirements)
• Religious information (e.g. dietary or observance requirements)
• Ethnicity data (where relevant to programme delivery and inclusion)

This information is collected solely for the purposes of ensuring the safety, wellbeing, and inclusion of participants attending our programmes, including making appropriate adjustments for dietary, medical, or religious needs. We only collect the minimum information necessary for these purposes.

We keep a record of any e-mail communication you send us, so we can track any problems or concerns you’ve had and to ensure we have an audit trail.

In addition to personal information, our website uses Google Analytics to ensure we are meeting your customer needs. Google Analytics stores usage data which may include your IP address, geographical location, referral source, length of visit and page views – although a lot of this is aggregated data. The legal basis for this is legitimate interest for the basis of ensuring we are meeting customer needs.

We may process information you submit to us when you contact us for the purposes of ensuring we answer your query effectively.

BulliesOut kindly request that you do not supply any other person’s personal data to us, unless required by law or you have their explicit consent to do so.

How We Use Your Personal Data

All the data we gather via our website or through communication with you is used to operate and expand the service we offer you and to personalise our service. How we use your personal data is dependent on the legal basis for processing your data. We are dedicated to using your personal data only for:

1. Processing your orders correctly.
2. Development and expansion of the business.
3. Technical management of our website.
4. Reviewing our systems
5. Providing you with information about the services we offer.
6. Letting you know about offers and news.

Legal Basis for Processing Data

BulliesOut relies on the following lawful bases under Article 6 UK GDPR:

• Consent – for example, where individuals opt into marketing communications
• Contract – where individuals engage with our services
• Legal Obligation – for compliance with legal and regulatory requirements
• Legitimate Interests – to operate and improve our services, including delivering safe and inclusive programmes

Examples of our lawful bases in practice:

• Delivering educational and outreach programmes: Legitimate Interests
• Managing volunteers and programme participants: Contract and/or Legitimate Interests
• Processing safeguarding information: Legal Obligation and/or Safeguarding Purposes
• Sending newsletters or marketing communications: Consent

Special Category Data

Where we process special category data, we rely on:

• Explicit consent (Article 9(2)(a) UK GDPR), obtained at the point of data collection from the individual or, where appropriate, their parent or guardian.
• In limited circumstances, we may also process such data where necessary to protect the legal obligation and/or safeguarding purposes.

Providing special category data is intended to support participant safety and inclusion. Where possible, individuals may choose not to provide this information, however this may limit our ability to fully accommodate specific needs.

Requesting Your Information

If you would like to review the data you have provided to us because you feel that what we presently have on record is incorrect and/or you would like your data erased from our records, you can so do by contacting us using the contact details below.

Under UK GDPR you have a right to be forgotten, to withdraw your consent, to change information we hold about you, and to restrict processing.

BulliesOut are more than happy to comply with this in accordance with the law.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.

How We Protect Data

You recognise that the Internet is not a 100% secure platform for communication and, accordingly, we cannot guarantee the security of any data you send to us (or we send to you) via the Internet. We are not responsible for any damages which you, or others, may suffer as a result of the loss of confidentiality of such information.

We take every precaution to safeguard your information. All personal data stored by us is kept on a server in a secure environment. The computer on which work is conducted on is password protected, data held in the cloud is password protected and held on encrypted systems and third-party software have their own security systems. Physical data is held in locked storage within secure premises.

While we take appropriate technical and organisational measures to protect data, no system can be guaranteed to be completely secure.

How You Can Help Us Protect Your Data

Please bear in mind that whenever you willingly divulge personal data online in non-protected situations – for example on message forums, through email, or in chat spaces – that data can be collected and used by others. In short, if you post personal data online that is accessible to the public, you may receive unsolicited communications from other parties in return. Also remember to close your browser window when you have finished using the computer. This is to ensure that others cannot access your personal data and communications. If you share a computer with someone else or are using a computer in a public place like a library or Internet café. We cannot confirm or warrant the security of any data you communicate to us, and you do so at your own risk. Once we receive your communication, we make our best effort to ensure its security on our systems.

Further Information

If you have questions about your personal data or our privacy policy, please contact us. To see all the information we have about you, and to correct any inaccuracies, please write to us.

Changes to Privacy Policy

We reserve the right to amend our privacy policy, whilst keeping it within all appropriate legislation and guidelines. We will do all we can to ensure that these pages show the most up to date information always and may notify you of such changes by uploading the revised privacy policy on the BulliesOut website.

Cookie Policy

We use a cookie consent mechanism to obtain your preferences before placing non-essential cookies.

Our Cookie Policy:

Please note: to make full use of the BulliesOut website and to benefit from a selection of personalised features, your computer, tablet or mobile phone will need to be set up to accept cookies.

• BulliesOut uses cookies to deliver the best user experience possible, without them we wouldn’t be able to enable essential website functionality such as remembering preferences and maintaining basket contents. The cookies we use don’t store sensitive data such as your name, address or payment details and they can’t harm your computer.
• The data we collect through these cookies is solely to improving our website and your browsing experience – it is never used to identify you, and we would never sell or share this data.

What is a cookie?

A cookie is a small text file which is downloaded and stored on your computer or mobile device by websites that you visit.

Your browser accesses the cookie file only when you visit the website that produced it. This helps to ease your navigation by automatically logging you in and remembering things like your preferences and what’s in your shopping basket.

The information stored within any given cookie can only be accessed by the website that created it and cookies are limited to communicating only the information that you have disclosed to the site.

Types of Cookie:

Session (or Transient) Cookies

Session cookies are stored in your computer’s memory for the length of your browsing session. They become inaccessible after the session has been inactive for a time and are automatically deleted from your computer when the browser is closed. They allow you to move from page to page without having to log-in repeatedly. Persistent (or Permanent) Cookies

Persistent Cookies

Persistent cookies are stored in your computer memory and are not deleted when the browser is closed. They are used to keep your preferences for the website, so they will be remembered for next time you visit the website. They are also used to collect information about the numbers of visitors, the average time spent on a particular page and analyse shopping behaviour on the website. This information is used to find out how well the website works and where it can be improved.

Contact Information

BulliesOut is the data controller for the personal data we process.

BulliesOut | T109, Titan House, Cardiff Bay Business Centre, Lewis Road, Cardiff, CF24 5BS

Registered Charity Number 1123070

Email: trustees@bulliesout.com

Website: www.bulliesout.com

The information above can also be used to contact our registered Data Protection Officer.

Privacy Policy Last Updated: April 2026