Privacy Policy

Our Details

The Citadel Youth Centre is a charity registered in Scotland (SCIO registration number: SC047933) and a company limited by guarantee registered in Scotland having our registered office at 175 Commercial Street, Edinburgh, EH6 6JE.

Purpose of this Privacy Policy

This Privacy Policy aims to give you information on how The Citadel Youth Centre collects and processes your personal data through your use of this website, our services, participations at events, when you make a donation, and any other contact you may have with us where you pass on your details. 

Who Collects and Control Your Data

Our privacy policy relates to any personal details we hold or collect about you.

Data Controller

Citadel Youth Centre is the controller and is responsible for your personal data (collectively referred to as “we”, “us” or “our” in this Privacy Statement). The Data Controllor is responsible for overseeing questions in relation to data protection and this policy.

Data Processor

The Citadel Youth Centre is one of the data processors of your data and is responsible for your personal data (collectively referred to as “we”, “us” or “our” in this Privacy Statement). The Data Controller who is responsible for overseeing questions in relation to this Privacy Statement.

Contacting Us

If you would like to make an enquiry about data protection, update the information we hold about you, request a copy of the information we hold about you or opt out of receiving marketing, please contact the Data Protection Manager as follows;

By Email:

‍‍info@citadel.scot

By Post:

The Manager, Citadel Youth Centre SCIO,
175 Commercial Street, Edinburgh, EH6 6JE

Phone:

0131 554 0510

You have a right at any time to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, welcome the opportunity to deal with any concerns you may have prior to you approaching the ICO so we may resolve your complaint and make things right. Please contact us at the details above.

Changes to the Privacy Policy

Our privacy policy is a live document and may therefore change from time to time as our communication activities change. All changes will be published here, on our website. This version was last updated on 29/09/2025.

It is important that the personal data we hold about you is accurate and current. While we make every attempt to keep information we retain accurate, we request that you let us know if your personal data changes during your relationship with us.

What Information We Collect About You

When we refer to personal data or information in this policy we mean any information that relates to you or may be associated with you. Personal information is collected directly from you when you interact with The Citadel Youth Centre, for example enquiring about a club, filling in an enquiry form, making a donation (of any kind), sending or receiving an email, making an enquiry by post, phone, email, or social media platforms, visiting our websites, applying for a role with us, applying for a volunteer role with us, participating in an event or when signing up to a campaign or to receive our newsletter. Information may be collected in person, over the phone, via email, through our website(s), social media platforms, or from something you’ve posted to us.

Information about you may be collected by third parties on our behalf, such as fundraising agencies we engage with. We may also have information about you passed to us in the interest of child safety and safety from a member of the public, or regulatory and authority bodies or organisations such as the Social Care Direct, Police, or Councils.

The information we hold will typically include some of, or all of the following:

• your name

• postal and email addresses

• your phone number

• financial transaction history with us

• previous communication with us

• details of how and why you have contacted us

It may also include information like your date of birth and your bank details if you are supporting us financially. We may also receive information about you from other sources (including public sources). This is explained in the ‘How we might use your information’ section below.

How We Use Your Information If You Are a Supporter Or Customer

Processing Your Donation 

When you make a donation or other payment to The Citadel Youth Centre, we will use your payment and contact details, payment amount, date and time of payment; to process that payment and take any follow-up administrative action needed (for example, sending a receipt).

If you choose to include Gift Aid with a donation to us, then we will also ask for your address and UK taxpayer status as this information is required by law. This information is needed for us to fulfil our obligations under tax and charity law. Information associated with Gift Aid declarations must be retained for 6 years from the end of the last financial year to which they relate. This information will be shared with HMRC for tax regulation purposes and may also be shared with the Fundraising Regulator and the Charity Commission in the event of an enquiry or investigation.

We have a contractual obligation to process your data when making a payment. If you have donated to us we may use the contact details provided to communicate with you about the work of the service, our events, services, appeals and campaigns unless you have told us not to do so.

We use your and our legitimate interests as our lawful basis for communicating with you about the Citadel as we feel you have shown legitimate interest in our work by supporting us.

When contacting you in relation to your initial enquiry we will do so in the manner you have contacted us by responding to your email, phoning, or writing to you by post. When contacting you about the Citadel for a purpose outside that which you initially engaged with us on we will only do so by phone or post, unless you have given us permission to contact you via email or SMS. If we have gotten this wrong, and you do not want to receive communications from us outside of the specific purpose you first engaged with us on, or would like us to communicate with you in a different way, you can let us know simply and easily as detailed above in the “Contacting Us” section of this policy.

Responding To Enquiries

If you contact us with a question, comment, compliment or complaint then we will keep a record of this communication and the personal details you have provided so that we have the information available in the event of a follow-up, dispute or investigation. This includes enquiries made via our website, email, telephone, post or via our social media channels. This information may be seen by managers, office staff and volunteers at the Citadel. Details of complaints and compliments may be shared with other staff or 3rd parties involved in order to provide feedback or improve our services.

When contacting you in relation to your initial enquiry we will endeavour to do so in the manner you have contacted us by responding to your email, phoning, or writing to you by post.

Event Information

If you participate in an event that we have organised, we may ask you to provide information to make sure we can manage the event safely and efficiently. We may also ask you for details of any dietary requirements and accessibility needs which you may have, so that we ensure our event is inclusive, in line with the provisions of the Equality Act 2010.

We will communicate with our event attendees by email, phone or post to offer information that will affect their attendance on the day.

If you participate in an event organised by an external party or donate through a processor like JustGiving, then your information may be passed to us by the processor.

We have a contractual obligation to process your data when taking part in an event with us either as a participant, supplier, or service provider.

If you have taken part in one of our events we may use the contact details you have provided to communicate with you about the work of the Citadel, our events, services, appeals and campaigns unless you have told us not to do so. We use your and our legitimate interest as our lawful basis for communicating with you about the Centre as you have shown legitimate interest in our work by supporting us.

When contacting you in relation to your initial enquiry we will endeavour to do so in the manner you have contacted us by responding to your email, phoning, or writing to you by post. When contacting you about the Centre for a purpose outside that which you initially engaged with us on we will only do so by phone or post, unless you have given us permission to contact you via email or SMS. If we have gotten this wrong, and you do not want to receive communications from us outside of the specific purpose you first engaged with us on, or would like us to communicate with you in a different way, you can let us know simply and easily as detailed above in the “Contacting Us” section of this policy.

Our Newsletter

If you have signed up via our website to receive our newsletter, we will send you this via the email address you have provided using your consent as our lawful basis for doing so. We may also make contact to keep you informed of Citadel Youth Centre’s vital work. If you have supplied us with your email address, we may use these details to communicate updates on our events, campaigns and services that we think you might be interested in. If we have gotten this wrong, and you do not want to receive communications from us outside of the specific purpose you first engaged with us on, or would like us to communicate with you in a different way, you can let us know simply and easily as detailed above in the “Contacting Us” section of this policy.

Marketing And Fundraising Communications

Email and SMS

Where you have provided your email address or mobile number and have opted in to receive emails and/or SMS from us, we may send you marketing and fundraising communications in that way. These communications may include information about our activities and their impact, our news, events and fundraising appeals, and other ways you can become involved with us. We use consent as our lawful basis for communicating with you via email or SMS as you will have given us consent to contact you in this way. If we have gotten this wrong, and you do not want to receive communications from us in this way, you can let us know simply and easily as detailed above in the “Contacting Us” section of this policy.

Post and Phone

Where you have provided us with your postal address we may send you occasional communications by post including our Friends of Citadel newsletter, information on our activities and donor appeals unless you have asked us not to do so. If you have provided your telephone number, we may call your telephone with information on campaigns or to ask you to donate to one of our appeals, unless you have asked us not to do so.

You can let us know at any time, if you’d prefer to change how we share information with you or stop it altogether. Simply contact us on 0131 554 0510 or info@thecitadel.scot or if you receive our e-newsletter or other emails, you can also use the unsubscribe link at the bottom of the email.

We will keep your personal information for no longer than is necessary for the purposes for which it is processed (in accordance with our internal policies/retention policy). If you ask us not to contact you, we will keep some basic information about you in order to avoid sending you unwanted materials in the future.

Cookies, Remarketing and Customer Analysis

To get the best possible fundraising results for the Citadel, we may do some research and analysis to inform our marketing and fundraising decisions. We may use technology to do this in the form of cookies or tracking software. We may also use post codes we have collected to track the areas in which our customers or supporters are most active. We usually cannot identify you when using these methods. We carry out the following activities:

Analysing how emails are opened and read – we track emails which we have sent to you to see which messages have the highest response rates and whether there are messages that resonate with particular groups of people. We do this by logging whether emails we send have been opened, deleted and interacted with (for example, by clicking on links within the emails).

Segmentation – this is where we analyse information such as postcodes of supporters, and whether donations have been given regularly. This helps us to tailor appropriate communications to you, as well as improve your experience as a Citadel Youth Centre supporter.

Cookies – we use cookies on our website and sometimes in emails. Cookies are a way of your preferences being stored on our website. When you access our websites, some cookies are saved to your computer, for example if you have chosen a particular language setting or created a user account. Functional cookies are required to ensure we are able to process your donation. You can turn off your cookies in your web browser so that we can’t access this information. You can also install the Google Analytics Opt-out Browser Add-on here, which will prevent data being used by Google Analytics for analysis and remarketing purposes.

Use of external sources – We use various social media platforms as third party data controllers and processors to help us target advertising to platform users who we feel may be interested in our work or support our cause. Where you have given us your personal data we may use this to create mosaic profiles to target new supporters. Where you have given us consent to use your personal data (such as your email address) we may use this to target advertising to you via social media platforms.

You can request more information on these activities, or change your preferences, at any time by calling us on 0131 554 0510 or emailing info@citadel.scot

How We Use Your Information If You Apply For A Job With Us

We sometimes use third-party job application platforms and recruitment services to publish and receive applications for our vacancies. When you apply through these portals the organisation’s privacy information will be available to you. We only work alongside other organisations in this way if we are satisfied that they will keep your information safely and use it only in the same legal ways that we would.

We May Use Your Information to Enforce and Comply with the Law

As with all charities, we ensure that our activities comply with the law. Therefore, we may need to share or use your personal information if we are required to do so by law (for example; in response to a warrant or court order) and we may use information from other sources for the purposes of fraud prevention, for example to comply with money laundering regulations, or to protect people’s rights, property or safety.

If certain levels of donation are made, the Fundraising Regulator’s Code of Fundraising Practice requires us, and all charities in the UK, to perform checks. More details can be found at www.fundraisingregulator.org.uk.

Closed Circuit Television (CCTV)

The Citadel Youth Centre uses CCTV for the following purposes;

• Prevention and detection of crime, harassment or disorder.
• Apprehension and prosecution of offenders.
• Provision of evidence in criminal proceedings.
• Interest in public and employee safety.
• Protection of property and assets.
• To request a copy of our CCTV Policy please call us on 0131 554 0510 or emailing info@citadel.scot

Photography

The Citadel may take still photographs or live video footage at events associated with the Citadel.

Change of Purpose

We will use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, your legitimate interest, or the legitimate interest of the Citadel.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note, we may process your personal data without your knowledge where this is required by law.

Data Security

We have put in place appropriate security measures to prevent your personal details from being accidentally lost, used or accessed by unauthorised personnel, altered or disclosed. We limit access to your personal information to only those employees, contractors or other third parties who have a genuine business “need” to know. Authorised persons accessing your personal information do so within the limits and controls of our data Protection Policy.

We have procedures in place to deal with any suspected data breach promptly and will notify you and any applicable regulator of a breach where we are legally required so to do.

Data Retention

We will only retain your personal data for as long as is reasonably necessary to fulfil the purpose for which we originally collected it, including for the purposes of satisfying any legal, accounting or statutory reporting requirements.

How We Share Your Data

The Centre will only ever share personal details of our customers and supporters with agencies working on our behalf. For example, mailing services who send our marketing and fundraising materials on our behalf, fundraising agencies who may contact you with information about appeals or campaigns, and or our website provider, who will analyse website usage on our behalf.

Organisations we work with who process personal information in the USA (for example our Mailchimp email marketing platform) have verified their data processing standards meet the EU-US Privacy Shield, which sets out clear safeguards and transparency responsibilities for US-based organisations processing personal information from EU citizens.

Additionally, we will share information as directed and required in accordance with the legislative requirements of the United Kingdom.

Local Authorities: We may be legally obliged to share your data with the police or local authorities if a child protection concern is raised. 

Third party platforms: We use several third party platforms to help us communicate with you, store your data, or process your data. We limit the amount of data we share to only that which is essential for their purposes. Any personal data which is not covered under a retention policy is destroyed.

Some third parties we work with are the data collectors and share your data with us. This may be if you signed up for an event or to donate through a third party website. Once your data is passed to us it is subject to all the conditions and retention periods stated above.

Your Legal Rights

You have the protection of several rights under data protection laws in relation to your personal data;

• Request access to your personal data
• Request that a correction is made to your personal data
• Request that we erase your personal data (full erasure may not be possible for legal reasons)
• Object to the processing of your personal data
• Request restrictions to the processing of your personal data
• Request a transfer of your personal data
• Exercise your right to withdraw consent

If you wish to exercise any of the rights set out above, please contact the Data Protection Officer. You will not usually have to pay a fee to access your personal data (or any other of the rights listed above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may also refuse to comply with your request in these circumstances.

We will endeavour to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is of a complex nature or if you have made several requests. In this case we will notify you and keep you updated.