Privacy Notice
How we collect, use, and protect your personal data
1. Who We Are
Raising Young Farmers CIC is a community interest company registered in England and Wales. We provide farm-based educational programmes for children and young people aged 0–16 at Tablehurst Farm, Forest Row, East Sussex, RH18 5DP.
For the purposes of data protection law, Raising Young Farmers CIC is the data controller. This means we decide how and why your personal data is used.
| Organisation | Raising Young Farmers CIC |
| Address | Tablehurst Farm, Forest Row, East Sussex, RH18 5DP |
| admin@tablehurstyoungfarmers.org | |
| Website | www.tablehurstyoungfarmers.org |
If you have any questions about this Privacy Notice or how we handle your data, please contact us using the details above.
2. What Data We Collect
We collect personal data about parents, carers, and children who enquire about, register for, or attend our programmes.
2.1 Parent and Carer Information
- Full name
- Email address
- Telephone number
- Home address (where provided)
- Relationship to the child
- Emergency contact details
- Payment and bank transfer information (we do not store bank account numbers — we receive transfers and record payment status only)
2.2 Child Information
- Full name
- Date of birth and age
- Programme and session enrolled in or enquiring about
- Trial session dates and attendance records
2.3 Special Category Data (Sensitive Information)
We collect certain sensitive information about children where it is necessary for their safety and wellbeing during sessions. This includes:
- Medical conditions — allergies, asthma, epilepsy, diabetes, or any condition that may affect the child during outdoor farm activities
- Dietary requirements — for cooking activities and shared meals
- Special educational needs (SEN) and disabilities — to ensure we can provide appropriate support and reasonable adjustments
- Neurodivergent conditions — such as autism or ADHD, so our facilitators can adapt activities and communication
- Medication requirements — where a child needs medication administered during sessions (with written parental consent)
- Behavioural or emotional needs — where parents share information to help us support their child
This data is classed as "special category data" under the UK GDPR and is subject to additional protections (see Section 4).
2.4 Photographs and Video
With your written consent, we may take photographs or video of children during sessions for use on our website, social media, newsletters, or funding applications. See Section 9 for full details.
2.5 Enquiry and Communication Records
- Enquiry form submissions
- Email correspondence between parents and RYF
- Notes from telephone conversations (where relevant to your child's placement)
3. How We Collect Your Data
| Collection Point | What We Collect |
|---|---|
| Public Enquiry Form (Google Forms) | Parent name, email, children's names and ages, session interest, how you heard about us |
| Trial Registration Form (Google Forms) | Child's name, DOB, medical conditions, allergies, dietary requirements, SEN information, emergency contacts, photo consent — collected for insurance and safeguarding purposes |
| Email correspondence | Information you share with us by email, including any details about your child's needs |
| Registration (on enrolment) | Contact details, session details, payment arrangements |
| During sessions | Observations relevant to safeguarding or your child's wellbeing (recorded only where necessary) |
4. Why We Collect Your Data and Our Legal Basis
Under the UK GDPR, we must have a lawful basis for processing your personal data.
4.1 Standard Personal Data
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Responding to your enquiry and arranging trial sessions | Legitimate interests (Article 6(1)(f)) |
| Managing your child's enrolment, attendance, and session records | Contract (Article 6(1)(b)) |
| Processing payments and maintaining financial records | Contract (Article 6(1)(b)) and Legal obligation (Article 6(1)(c)) |
| Sending session reminders, schedule changes, and operational communications | Legitimate interests (Article 6(1)(f)) |
| Safeguarding and child protection | Legal obligation (Article 6(1)(c)) and Vital interests (Article 6(1)(d)) |
| Complying with insurance requirements | Legal obligation (Article 6(1)(c)) |
4.2 Special Category Data (Medical, SEN, Health)
| Purpose | Lawful Basis | Additional Condition |
|---|---|---|
| Managing medical conditions, allergies, and medication during sessions | Article 6(1)(d) — Vital interests | Article 9(2)(c) — Vital interests where the child cannot give consent |
| Supporting children with SEN or additional needs | Article 6(1)(f) — Legitimate interests | Article 9(2)(g) — Substantial public interest (Schedule 1, Part 2, Para 18 DPA 2018) |
| Safeguarding records and referrals | Article 6(1)(c) — Legal obligation | Article 9(2)(g) — Substantial public interest (safeguarding of children) |
4.3 Photographs and Video
| Purpose | Lawful Basis |
|---|---|
| Taking and publishing photographs or video of children | Consent (Article 6(1)(a)) — we will always ask for your written consent before photographing your child. You may withdraw consent at any time. |
5. How We Store and Protect Your Data
| System | What Is Stored | Security |
|---|---|---|
| Google Workspace (Gmail, Sheets, Drive, Calendar) | Email correspondence, enquiry and registration form responses, enrolment records, calendar bookings | Google Workspace account with 2-factor authentication, access restricted to authorised staff |
| Internal records | Family records including contact details, children's information, session history, payment status | Stored on secured systems with access restricted to the director and authorised administrators |
| Paper records (if any) | Safeguarding concern forms, incident reports | Stored in a locked cabinet, accessible only to the Designated Safeguarding Lead and the Chair of the Board |
We do not store your bank account details. Payments are made by bank transfer directly to our account, and we record only that a payment has been made and its reference.
All electronic data is backed up and access is restricted on a need-to-know basis. We do not transfer your data outside the United Kingdom except where Google Workspace servers may process data in accordance with Google's own data protection commitments and Standard Contractual Clauses.
6. Who We Share Your Data With
We do not sell your data to any third party. We do not share your data for marketing purposes. We may share your personal data with the following parties, only where necessary:
| Recipient | Purpose | Legal Basis |
|---|---|---|
| East Sussex County Council (Children's Social Care / SPOA) | Where we have a safeguarding concern about a child | Legal obligation — safeguarding duty |
| Police | Where a child is at immediate risk of harm | Legal obligation / vital interests |
| Local Authority Designated Officer (LADO) | Where an allegation is made against a member of staff | Legal obligation |
| Our insurers | To maintain public liability and employer's liability insurance | Legitimate interests / legal obligation |
| HMRC | Tax and accounting obligations | Legal obligation |
| Google (as a data processor) | Google Workspace processes data on our behalf for email, forms, and storage | Contractual — Google acts as our data processor under their Data Processing Agreement |
Safeguarding exception: Under Working Together to Safeguard Children 2023, where there is a safeguarding concern about a child, the duty to share information with relevant authorities overrides normal data protection considerations. We will always act in the best interests of the child.
7. How Long We Keep Your Data
| Data Type | Retention Period | Reason |
|---|---|---|
| Enquiry form submissions (where the family does not proceed) | 12 months after last contact | Legitimate interest |
| Enrolled child's records (contact, session, attendance) | Until 2 years after the child leaves the programme | Contractual and legitimate interest |
| Financial and payment records | 6 years after the end of the financial year in which the transaction occurred | Legal obligation — HMRC and Companies Act |
| Safeguarding records | Until the child's 25th birthday, or longer if relevant to ongoing proceedings | Legal obligation — statutory guidance (Working Together 2023) |
| Photographs and video | Deleted when consent is withdrawn, or when no longer needed for the stated purpose | Consent-based |
| Staff DBS and training records | 6 months after employment ends (DBS certificate number and date retained) | Legal obligation and legitimate interest |
| Email correspondence | 3 years after last contact | Legitimate interest — continuity of communication |
8. Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
8.1 Right of Access (Subject Access Request)
You have the right to request a copy of the personal data we hold about you and your child. We will respond within one calendar month.
8.2 Right to Rectification
If any of your personal data is inaccurate or incomplete, you have the right to ask us to correct it. Please let us know if any of your details change.
8.3 Right to Erasure ("Right to Be Forgotten")
You may ask us to delete your personal data. We will do so unless we have a legal obligation to retain it (for example, safeguarding records or financial records required by law).
8.4 Right to Restrict Processing
You may ask us to limit how we use your data in certain circumstances, for example while we investigate a concern you have raised about accuracy.
8.5 Right to Data Portability
Where we process your data based on consent or contract, you have the right to receive your data in a commonly used, machine-readable format.
8.6 Right to Object
You have the right to object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
8.7 Rights Related to Consent
Where we process data based on your consent (for example, photographs), you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.
How to Exercise Your Rights
To exercise any of these rights, please contact us:
- By email: admin@tablehurstyoungfarmers.org
- By post: Raising Young Farmers CIC, Tablehurst Farm, Forest Row, East Sussex, RH18 5DP
We will respond to your request within one calendar month. If your request is complex, we may extend this by a further two months, but we will let you know within the first month. There is no fee for exercising your rights in most circumstances.
9. Photographs and Video
We may wish to take photographs or video of children during sessions for use on our website, social media accounts, newsletters, or funding applications.
- We will always ask for your written consent before photographing or filming your child
- The consent form specifies exactly how images may be used
- You may withdraw consent at any time by contacting us — we will remove images from use as soon as reasonably practicable
- Children will never be identified by full name alongside their image without separate, explicit consent
- All images are stored on RYF systems only — staff may not use personal devices to photograph children
- Images are deleted when consent is withdrawn or when they are no longer needed
10. Children's Data
As an organisation that works primarily with children, we take particular care with children's personal data:
- We collect children's data from their parents or carers, not directly from the children themselves
- We process children's data only where necessary for the purposes set out in this notice
- We apply the highest standards of security and access control to children's data
- We conduct periodic reviews of the children's data we hold and delete data that is no longer needed
- Where a child turns 13 during their time with us, we recognise their developing right to exercise their own data subject rights alongside their parent or carer
11. Cookies and Website
Our website (https://www.tablehurstyoungfarmers.org) may use cookies for basic functionality and analytics. Our enquiry and registration forms are hosted on Google Forms, which is subject to Google's own privacy policy.
12. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or in data protection law. We will notify you of any significant changes by email or by placing a notice on our website. This notice was last updated on 9 March 2026.
13. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
| Website | ico.org.uk |
| Telephone | 0303 123 1113 |
| Post | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
We would always appreciate the opportunity to address your concerns directly before you contact the ICO. Please contact us first.