Important: This is a working draft, not an approved privacy notice. The items in square brackets must be completed and checked by the appropriate GROWTH organisation(s) before the notice is issued. Do not guess the data controller, lawful basis, contact details, retention period or data-sharing arrangements.

The organisation responsible for deciding how and why your personal data is processed (the data controller) is: [INSERT CONFIRMED LEGAL NAME OF DATA CONTROLLER OR CONTROLLERS].

GROWTH is delivered by partner organisations. The controller arrangements for information collected through GROWTH activities must be confirmed before this notice is approved. Where more than one organisation is a controller, explain each organisation’s role and whether they act independently or jointly.

Project contact: [INSERT ROLE/TEAM AND EMAIL OR POSTAL ADDRESS].

Data Protection Officer or data protection contact: [INSERT CONFIRMED CONTACT DETAILS, OR EXPLAIN THE APPROVED ALTERNATIVE].

Depending on the activity and the information needed for project monitoring, we may collect limited information such as:

• a participant reference or Unique Participant Number (UPN), where used;
• attendance and participation information, such as the activity, session, date and delivery location;
• responses to feedback or monitoring questions about the activity and your experience;
• information needed to report required project outputs and results, including relevant demographic information only where it is required and appropriate;
• contact details, only where they are genuinely needed for a stated project purpose and the relevant process has been explained to you.

We should collect only information that is relevant and necessary for the stated purpose. Please do not include detailed medical information or other sensitive personal details in open comment boxes unless you have been specifically asked to provide them through an approved process.

Subject to confirmation of the final purposes for each data collection process, information may be used to:

• administer and record participation in GROWTH activities;
• monitor delivery and assess whether activities, deliverables, outputs and results are being achieved;
• understand participants’ feedback and experiences and support project evaluation and improvement;
• prepare required project and programme reports;
• provide evidence for authorised monitoring, verification, audit or evaluation checks; and
• meet applicable legal, contractual and programme requirements.

The project team should only use the information for purposes that have been confirmed and communicated to participants.

[TO BE COMPLETED BY THE RESPONSIBLE CONTROLLER(S): state the confirmed lawful basis under Article 6 UK GDPR for each relevant purpose, and explain it in plain language. If special-category data is processed, identify the applicable Article 9 condition and any required supporting condition or safeguards.]

Do not assume that the lawful basis used by the PEACEPLUS Managing Authority or the Special EU Programmes Body is automatically the lawful basis used by a GROWTH partner. The responsible controller(s) must confirm and document the basis for GROWTH’s own processing.

[CONFIRM WHICH INFORMATION IS REQUIRED FOR PARTICIPATION, WHICH IS REQUIRED FOR PROGRAMME MONITORING, AND WHICH IS OPTIONAL.] Explain what happens if a participant does not provide information that is genuinely required. Do not describe optional feedback as compulsory.

Where feedback is optional, participants should be told that they may leave questions unanswered without being pressured to respond. Any consent process used for a particular activity, photograph, case study or other purpose should be explained separately where required; this privacy notice does not itself constitute consent.

Access should be limited to people and organisations that need the information for an authorised purpose. Depending on the confirmed arrangements, this may include relevant GROWTH delivery partners, approved service providers, and PEACEPLUS programme bodies or other authorised bodies for monitoring, verification, audit or evaluation.

[CONFIRM THE ACTUAL RECIPIENTS, THE INFORMATION SHARED WITH EACH, AND THE PURPOSES FOR SHARING. Explain whether information is shared between partner organisations and whether any transfers outside the UK/EEA occur.]

Where programme reporting can be completed using aggregated or anonymised information, that should be used rather than unnecessary identifiable participant data. Any identifiable records retained for verification or audit should be stored securely and made available only as authorised.

The responsible organisation(s) should use appropriate organisational and technical safeguards, including restricted access, secure storage and secure transfer arrangements, to protect personal information against unauthorised access, loss, alteration or disclosure.

[CONFIRM THE APPROVED STORAGE SYSTEMS, ACCESS ARRANGEMENTS AND ANY RELEVANT PROCEDURES BEFORE ISSUE. Do not include security details that would create an avoidable risk.]

[INSERT THE CONFIRMED RETENTION PERIOD OR APPROVED RETENTION RULE FOR EACH RELEVANT RECORD TYPE, including attendance records, monitoring forms, feedback, case studies and any contact details. Explain when the period starts and what happens at the end of it.]

The retention rule must reflect the responsible controller’s approved retention schedule and any applicable PEACEPLUS, audit, verification, funding or legal requirements. Do not insert an assumed number of years without checking the applicable rule.

Depending on the circumstances and the lawful basis that applies, you may have rights under data protection law, including to request access to your personal data, ask for inaccurate information to be corrected, request erasure or restriction, object to certain processing, or request data portability. These rights are not absolute and may not all apply in every case.

To ask a question or make a request, contact: [INSERT CONFIRMED PRIVACY/DATA PROTECTION CONTACT].

[CONTROLLER TO CONFIRM THE RIGHTS THAT APPLY TO ITS PROCESSING, HOW REQUESTS ARE HANDLED, AND ANY RELEVANT EXEMPTIONS BEFORE APPROVAL.]

If you have a concern about how your personal data is being handled, please contact [INSERT CONFIRMED CONTROLLER/DATA PROTECTION CONTACT] in the first instance.

You may also be able to complain to the relevant data protection supervisory authority. The appropriate authority and contact details should be confirmed for the controller and the participant before this notice is issued. For organisations subject to the UK GDPR, the Information Commissioner’s Office (ICO) is the UK supervisory authority; the appropriate route may differ depending on the controller and circumstances.

The Special EU Programmes Body (SEUPB) publishes a separate privacy notice for its own programme delivery and management activities, including Jems:  

https://peaceplussupport.seupb.eu/privacy