Privacy Policy

1. Who we are

Project ReMAKE ("we", "us", "our") is an entrepreneurship programme for prison leavers and formerly incarcerated individuals. We are the data controller for personal data collected through this platform.

Project ReMAKE is a registered charity (no. 1198999), 20 Gainsborough Road, London, W4 1NJ (project-remake.org.uk). For any privacy query, or to exercise your data rights, contact us at support@remake365.com.

2. What data we collect

We collect the following categories of personal data:

• Identity data: full name, date of birth, age
• Contact data: email address, phone number, postal address, emergency contact details
• Protected characteristics: ethnicity, religion (voluntary)
• Application responses: education, work experience, business ideas, programme motivations
• Criminal conviction data (Article 10): conviction history, probation status, pending cases. This is special category data handled with additional safeguards.
• Digital signature: your drawn signature captured during document signing
• Uploaded files: documents and images submitted during your application or in response to information requests
• Photo consent: your preference regarding photography during programme activities

3. Lawful basis for processing

We process your data under the following lawful bases:

• Consent (Article 6(1)(a)): You provide explicit consent when submitting your application and completing onboarding forms.
• Legitimate interest (Article 6(1)(f)): To administer the programme, communicate with applicants, and improve our services.
• Criminal conviction data (Article 10): Processed on the basis of your explicit consent, which is the condition at Schedule 1, Part 3, paragraph 29 of the UK Data Protection Act 2018. We use it to assess your eligibility for the programme. You can withdraw that consent at any time by asking us to delete your data.

4. How we use your data

• To process and assess your application for the programme
• To conduct safeguarding assessments (including criminal conviction checks)
• To communicate with you about your application status, onboarding, and programme activities
• To contact your probation officer if necessary (only with your explicit consent)
• To generate programme reports and statistics (anonymised where possible)
• To send automated reminders about application deadlines and onboarding tasks

5. Data sharing

We share your data with:

• Programme staff and mentors: to assess your application and support you on the programme
• Partner universities: where relevant to your programme (e.g. Queen Mary University of London, University of Bradford)
• Google (email processor): we use Google Workspace to send application-related emails. Your email address and name are shared with Google for this purpose.
• Google (data storage): your application data is stored on Google Cloud infrastructure in Google's London region, in the United Kingdom.
• Probation services: only with your explicit consent and only when necessary for safeguarding assessment

We will never sell your data or share it with third parties for marketing purposes.

Sending data outside the UK. Your application data is stored in the United Kingdom. Some of the services we use to run the platform are provided by Google, and some of them may process data outside the UK:

• Email: the messages we send you, and the record that we sent them, are handled through Google Workspace.
• Document storage: if you give us a criminal record declaration, we transfer it to a Google Drive account controlled by Project ReMAKE and remove it from the platform.
• Paper application forms: if you apply on paper, a member of our team may use an approved AI assistant to turn your scanned form into the same structured information an online application produces. The tool used is recorded against your application. The scan itself stays the record we rely on.
• Analytics: only if you accepted analytics cookies. You can decline, and declining changes nothing else about the service.

Where a provider processes personal data outside the UK, we rely on the data protection terms in our agreement with that provider, which are intended to protect your data to the standard required here. You can ask us for more detail about those arrangements using the contact details in section 7.

6. Data retention

• Rejected applications: deleted 6 months after rejection
• Expired applications: deleted 3 months after expiry
• Accepted applicants: retained for the duration of the programme plus 6 years for safeguarding and regulatory purposes
• Criminal conviction data: retained only as long as necessary for programme eligibility assessment; deleted when the applicant leaves the programme
• Email logs: retained for 12 months

7. Your rights

Under UK GDPR, you have the right to:

• Access: request a copy of your personal data
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Restriction: ask us to pause what we do with your data while a question about it is being sorted out, for example if you have told us something is wrong and we are checking
• Withdraw consent: withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal
• Object: object to processing based on legitimate interests
• Complain: lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

You can do two of these yourself, right now, without asking anyone: Download my data and Delete my account are in your portal under *Your information*. For anything else, including correcting something, email us at support@remake365.com.

We answer every request within one month, which is the deadline the law sets. You never have to give a reason, and asking will not affect your application or your place on a programme.

8. Cookies

This platform uses essential cookies that are necessary for it to work, including keeping you securely signed in and protecting against fraud and abuse. These cannot be switched off.

We use Google Analytics to understand how the platform is used, such as which pages people visit and where they may need more help, so we can improve it. This only happens if you choose Accept on the cookie banner: until then, and if you decline, no analytics cookie is set and no usage data is collected. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back. We do not use advertising cookies and we do not track you across other websites. Some sites we link to (for example partner university websites) may set their own cookies; please refer to their cookie policies.

9. Security

We implement appropriate technical and organisational measures to protect your data, including: encrypted connections (HTTPS), role-based access controls, secure authentication, and regular security audits. Access to criminal conviction data is strictly limited to authorised programme staff.

10. Automated decision-making

We do not use automated decision-making or profiling in our application process. All applications are reviewed individually by a member of our team. You have the right to request a human review of any decision.

11. The Volunteer Hub

The Volunteer Hub connects founders who have completed a Project ReMAKE programme with volunteers who offer their skills. It involves people and purposes beyond the application process described above: volunteers, founders, people who subscribe to a founder's mailing list, and people who offer to help through our public volunteer form.

In the hub we process:

• Member profiles (name, contact email, organisation, skills, time you can give, a short bio, and the agreements you accept): to run the hub, check each new member before they can see or contact anyone, and match founders with volunteers. Lawful basis: legitimate interest (Article 6(1)(f)). Kept while your membership is active.
• Exchange activity (what was agreed, messages between the two of you, hours logged, progress): to run and record an agreed exchange between two members. Lawful basis: legitimate interest. Kept for the life of the exchange; your details are removed from it if you ask us to erase your data.
• Social value records: a pseudonymised record that an exchange was completed and the value it represents, used for anonymous reporting to funders. Lawful basis: legitimate interest. Kept pseudonymised after erasure so historical totals stay truthful; it contains nothing that identifies you.
• Testimonials and social posts: public recognition of a completed exchange, published only when both people have approved the exact wording and a member of our team has checked it. Lawful basis: consent (Article 6(1)(a)). Kept until withdrawn.
• Mailing-list subscriptions (your email address and the founder you followed): to send you that founder's updates. Lawful basis: consent, confirmed by double opt-in. Kept until you unsubscribe; unconfirmed sign-ups are deleted after 14 days.
• Hub activity (your member ID and the name of an action, such as viewing a page): to run matching and show you your own history. Lawful basis: legitimate interest, minimised to ID and event only. Deleted after 180 days.
• Volunteer enquiries from our public form (name, email, optional message): to follow up with people offering to help. Lawful basis: consent. Kept until we have contacted you or closed the enquiry.

12. How the hub protects you

• Every new member is checked first. Anyone can look at the hub, but nobody can see or contact another member until a member of our team has approved them.
• Founder pages run no third-party code. A founder's page is generated from typed, checked content by our own renderer. There is no embedded outside code, so visiting a founder page cannot read your session or data.
• The mailing list is private. A founder sees only how many people have subscribed, never who. Every email includes a one-click unsubscribe.
• Members cannot learn that you are a Project ReMAKE applicant. The hub is kept strictly separate from the application system: it never looks up, and members cannot see, anyone's application data.
• Approved members can see each other's profiles. Once our team has approved you, other approved members can see your first name, the skills you listed, and what you wrote about the time you can give. That is how founders and volunteers find each other, and it is the whole point of the hub. Your email address is never shown in it.
• Your contact details are shared only with the other person in an exchange, and only as far as needed to complete what you agreed.

If you ask us to erase your data, we remove your member record and the content you wrote, remove your details from any shared exchanges, and pseudonymise (rather than delete) historical social-value records so anonymous totals remain accurate. To exercise any right, contact us at the address in section 7.

13. Calls between members

Two members in an exchange can book a video call through the hub. The call runs on Google Meet. Calls are optional: the written workspace is always available instead.

For calls we process:

• Your availability (the weekly windows and blocked dates you declare): to offer the two of you times you can both make, without either of you seeing the other's calendar or email. Lawful basis: legitimate interest (Article 6(1)(f)). Kept while your membership is active.
• Call bookings (chosen time, length, who booked, cancellations, the video link): to run the call and keep a register of it. Lawful basis: legitimate interest. Kept for the life of the exchange; your details are removed from it if you ask us to erase your data.
• Your post-call answer (good, OK, or something concerned me; and after an intro call, whether you want to carry on): to spot problems early. "Something concerned me" tells our team to look at it, and a person reads it. Lawful basis: legitimate interest. Kept for the life of the exchange.
• Call recordings: video and audio of the call, recorded automatically and stored only in a Drive account controlled by Project ReMAKE. Purpose: safeguarding, so that evidence exists if either person raises a concern about what happened on a call. Lawful basis: legitimate interest, balanced by the sealed access described below and by the written workspace remaining a non-recorded alternative. Deleted automatically after 90 days, unless an open concern or a disputed exchange holds that one recording.
• Recording access records (who asked to see a recording, their written reason, who approved it, what was shared and when access was withdrawn): to prove a recording was only ever opened with due cause and by two people. Lawful basis: legal obligation (Article 6(1)(c), accountability) and legitimate interest. Kept as an audit record; it cannot be edited or deleted.

Calls are recorded, and almost never watched. Google Meet shows a recording notice and announces it in the call, and the calendar invitation says so in plain words. Nobody at Project ReMAKE watches a recording as a matter of course.

Opening a recording takes a concern, a reason and two people. There is no browse button and no standing access in the platform. A recording can only be requested after someone has flagged that call; a senior team member then records why, and a different senior team member has to approve it. Access is granted for a fixed window and then withdrawn, and every step is written to a log nobody can edit. If you ask us to erase your data, any recording of a call you took part in is deleted too, unless it is held for an open concern.

14. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date. Significant changes will be communicated to you via email.