Privacy & Cookies Policy

Second Corner connects young people with businesses that offer safe, paid placements. Both sides matter equally, so this policy covers:

• Businesses and their team members: the person who creates the business account, team members they invite, and the supervisors, health and safety and safeguarding contacts they name.
• Young people who create an account or take part in the programme.
• Parents and carers who give consent or contact us about a young person.
• School staff who work with us on placements.
• Website visitors, newsletter subscribers, and people who send us enquiries or suggestions.

You can ask us about any information we request before you provide it.

Second Corner is a programme run by Empath CIC (company number 15953119). Empath CIC is the data controller for information collected through this platform. ICO registration number: [to be confirmed]. Contact Ana Moutinho at ana@empath.org.uk for privacy enquiries or to exercise your rights.

Participating businesses remain responsible for employing, paying and supervising young people, obtaining required permits and providing suitable insurance. Schools and employers may also be responsible for their own records and should provide their own privacy notices.

Empath CIC, each partner school and each host business are separate data controllers. Each is responsible for its own records and decides for itself how it uses them. Schools keep their own pupil records. When a business hosts a young person, it is the young person’s employer and keeps its own employment, payroll, permit, insurance and supervision records. Each should give the young person its own privacy information.

Second Corner uses the information in a business application to check that the workplace, role, insurance and safeguarding arrangements are suitable, to offer support, and to match the business with young people. Our reviewers, not a computer, decide whether an application is accepted.

• People you name: if you give us details of supervisors or other contacts, please let them know you have shared them with us and point them to this policy.
• Team access: the account owner decides who is invited, whether each team member can edit only or also submit, and can remove access at any time. Team members can see and change the whole application and its documents.
• Insurer email: we prepare a draft email for you to send to your insurer or broker. We do not send it or contact your insurer ourselves. You upload their reply so our reviewers can see it.
• Young people’s information: host businesses see only what they need for the placement, such as first names, dates and attendance. Please keep it securely, use it only for the placement and do not share it further.

• Young people’s accounts: first and last name, email, date of birth, interests, experience and preferred boroughs. We use these to manage accounts, check age eligibility and support suitable opportunities. Passwords are handled by the account service and are not displayed to our reviewers.
• Business accounts and vetting: applicant name, job title, email, telephone and authority to apply; organisation identity, registration and placement addresses, activities and contacts; supervisor, health and safety and safeguarding contacts; insurance details, certificates and relevant age restrictions; policy and safety answers, hazards, declarations, support requests and any optional supporting documents. Team invitation email addresses, invitation status and access changes are also recorded. We use these to assess suitability, contact the business, provide requested support, enable authorised collaboration and record review decisions.
• Programme records: participant names, school, year group, cohort, mentor, parental consent date, placement dates and status, attendance, hours, check-ins, reflections, follow-up and employer feedback. These support matching, delivery, monitoring and evaluation. Records may come from participants, parents/carers, schools, employers and authorised programme staff.
• Parents/carers and media consent: contact details, the person concerned, permissions, name-display choices and digital signatures provided on consent forms. Photos, video and audio may be used only within the permissions given. Parents/carers will need their own account when that area is available; it is not yet available.
• Enquiries, suggestions and newsletters: the details and messages you provide, used to respond or send requested updates. Newsletter consent is separate from registration and you can unsubscribe.
• Security and website use: sign-in/session information, access and change records, and technical information used to operate and protect the service. Visitor statistics and Google Analytics are explained under “Cookies, visitor statistics and your choice”.

Required fields are needed to provide the relevant service or complete checks. Without them, an account, application or placement may not proceed. Optional notes, stage-one supporting documents and marketing consent are not compulsory. Please redact unrelated personal information from uploaded documents and do not upload children’s records into the business document area.

• From you: when you create an account, fill in a form, upload a document, sign a consent form or contact us.
• From a business: the account owner and invited team members provide details about the organisation, its contacts, roles, insurance and safety arrangements. Host employers also give feedback and attendance for placements.
• From a school: school contacts may share a young person’s name, year group and the support they need to take part.
• From a parent or carer: consent, contact details and information needed to keep a young person safe.
• From others: insurers or brokers (through the reply a business uploads), delivery partners, and public sources such as Companies House or the Charity Commission when we check a business.
• Automatically: sign-in records, change records and website statistics.

Paid placements are for ages 13–15. Young people can ask us questions or exercise their rights themselves; a parent or carer can help. We consider the child’s understanding, best interests and safety rather than treating parental permission as permission for every use of their information.

We plan to record limited additional needs and equality-monitoring information, which may include special educational needs or disability, free-school-meal eligibility, gender and ethnicity. Health, disability and ethnicity can require extra legal protection. Real sensitive programme information is not yet being recorded.

Before collecting this information, we must complete a data protection impact assessment, identify and document the applicable lawful basis and special-category condition, agree access and retention arrangements, and give participants and parents/carers a specific explanation. Optional equality monitoring must not determine access to a placement. The separate equality-monitoring area is restricted to administrators; reports use anonymous totals and hide groups smaller than five.

Safeguarding concerns must follow the safeguarding reporting process, not be placed in routine employer feedback or general notes. Necessary safety information may be shared with appropriate people to protect a child.

• Legitimate interests: operating accounts and applications, checking business suitability, coordinating opportunities, responding to enquiries, monitoring delivery and protecting the service. Our interests are safe programme delivery and accountable administration; we must balance these against your rights, with particular care for children.
• Consent: optional newsletters, analytics and specified media use. You can withdraw consent without losing access to unrelated services.
• Legal obligations: where a specific law requires us to retain or disclose information. An employer’s legal duties are not automatically Empath CIC’s legal basis.
• Protection and emergencies: where necessary and lawful to protect someone’s vital interests or meet applicable safeguarding requirements. We document the basis used in the circumstances.

Agreement to this notice is not blanket consent. Any special-category processing needs an additional condition before it begins.

AI tools: we do not currently use AI tools to process the personal information of young people, parents, schools or businesses. If we start, we will update this policy first and will only use suppliers that process information on our instructions and do not use it to train their own AI models.

Automated decisions: we do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects. People decide whether a business application is accepted and whether a young person is matched with a placement. The website may check that required answers are filled in before an application can be submitted, but this does not decide the outcome.

Business applications and uploaded documents are private to the business account owner, team members invited by that owner and authorised Second Corner reviewers. Invitations are limited to the invited email address; owners can remove team member access. Programme staff have access appropriate to their work. Linked school contacts see limited records for their school. Linked employer contacts see limited information for their placements, including first names rather than full student names; they do not receive access to the separate equality-monitoring records.

We may share necessary information with the relevant school, parent/carer, host employer, authorised delivery partner, council permit team or safeguarding service for the stated purpose. Funders and public reports should receive anonymous or aggregated information unless an identified disclosure is specifically justified and explained. We do not sell personal information.

Lovable Cloud provides account, record and private-file services. Email delivery services process addresses and messages to send confirmations and updates. Lovable provides our website visitor statistics. Google processes analytics when you opt in. Google Fonts are loaded from Google’s servers, which receive your IP address to deliver them. Embedded maps or videos may be provided by their own services. These service providers receive only information needed for their service. Following external links may take you to services with their own privacy and cookie notices.

All stored information and all connections to the website are encrypted. We also use restricted account access, private document storage and records of changes to protect information. No online service can guarantee absolute security. Contact us promptly if you think information has been disclosed incorrectly.

Service providers may process information outside the UK. Where a restricted international transfer takes place, an applicable adequacy decision or approved contractual safeguards and transfer assessment are required. We are confirming the provider locations and safeguards; contact us for the current details. We do not promise that all information stays in the UK.

We keep identifiable information only while it is needed for its stated purpose, legal requirements or a justified safeguarding, audit or dispute need. We have not yet adopted a final retention schedule. The following periods are proposed for approval, not a claim that automatic deletion is already operating:

• Incomplete business applications: review after 12 months without activity and contact the business before deletion.
• Withdrawn or declined business applications and supporting documents: normally 12 months after the final decision, unless an active complaint or legal need justifies longer.
• Approved business and placement assurance records: review a proposed six years after the relationship or relevant placement ends. Remove duplicate or superseded documents sooner if they are no longer needed.
• Routine identifiable student delivery and evaluation records: kept for 4–6 years after the young person leaves the programme, then delete or genuinely anonymise unless an evidenced requirement justifies longer. Review sensitive equality-monitoring records separately and remove identifiers as early as possible.
• Safeguarding and serious incident records: a separate, specialist-approved schedule is needed; routine application periods do not apply automatically.
• Newsletter subscriptions: until you unsubscribe; keep only the minimum suppression information needed to respect that choice. Media permissions: while the permitted use continues and for a justified period to evidence permission.

These proposed periods must be checked against school and funder agreements, insurance and safeguarding requirements before adoption. Account closure does not necessarily remove records still lawfully needed. Backup copies may remain for a limited recovery period; the provider’s backup and analytics retention settings are still being confirmed.

Essential account/session storage supports sign-in and security. Your analytics choice is stored in your browser as sc-cookie-consent until you change it or clear browser storage.

Visitor statistics (all visitors): Lovable, which hosts this website, counts visits for us. It uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify you. It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. Detailed data is kept for 90 days and daily summaries for a year. This is recorded for every visitor, whatever you choose below. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

Google Analytics (only if you accept): Google Analytics is loaded only after you accept. It processes visitor identifiers and information about pages, device and approximate location, and may set _ga and _ga_* cookies, commonly lasting up to two years depending on Google settings. We are checking the exact configured durations. Declining keeps Google Analytics from loading on subsequent page loads. Changing your choice below reloads the page; you can also remove previously stored cookies through your browser settings.

You can ask for access to your information, correction, deletion, restriction, or a portable copy where applicable. You can object to processing based on legitimate interests and withdraw consent at any time. These rights depend on the circumstances; we will explain if we need to retain information or cannot fulfil a request. Withdrawal does not undo lawful processing already carried out.

Young people may make requests directly, with support if they wish. Business account owners and team members can update most of their own details in the Business area; for anything else, contact us.

Our site links to other websites, such as Eventbrite, our petition and partner organisations. They have their own privacy and cookie policies, and we are not responsible for how they use information.

We update this policy when our collection or use of information changes, and change the “Last updated” date at the top. If a change significantly affects how we use your information, we will tell account holders by email or when they next sign in. We give additional notices where a particular activity needs them.

Email Ana Moutinho at ana@empath.org.uk, or use our contact page. We may need proportionate identity checks and normally respond within one month; if a lawful extension is needed, we will explain it.

If you are unhappy with how we have used your information, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, on 0303 123 1113.