The Underdog Crew CIC | Underdog Crew Studios

Last updated: 19 October 2026

Our commitment to your privacy

At The Underdog Crew, we believe everyone deserves to feel safe, respected and supported — and that includes how their personal information is handled.

We work with children, young people, parents, carers, families, volunteers, creative professionals and community organisations. We understand that some of the information shared with us can be particularly personal or sensitive.

Whether you are visiting our website, asking for support, joining an activity, attending an event or getting involved in our community, we are committed to protecting your privacy and being transparent about how we use your information.

This Privacy Policy explains what information we collect, why we collect it, how we keep it secure, when we may share it and the rights you have.

We handle personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

1. Who we are

The Underdog Crew CIC is a UK-registered Community Interest Company (CIC) operating as a not-for-profit organisation.

We provide community-based opportunities, creative education, filmmaking, mentoring, youth empowerment, family support, workshops, activities and events.

For the purposes of UK data protection law, The Underdog Crew CIC is the data controller for the personal information described in this policy. This means we are responsible for deciding how and why that information is processed.

Our details

• Legal name: The Underdog Crew CIC

• Company registration number: 14530067

• Registered office: 90 Goring Road, Colchester, England, CO4 0DA

• Studio: Units 6 & 7, Fox & Pheasant Centre, Colchester Road, White Colne, CO6 2PS

• Website: https://www.underdogcrew.org

• General enquiries: hello@underdogcrew.org

• Safeguarding enquiries: safeguarding@underdogcrew.org

For data protection questions, requests or complaints, please contact hello@underdogcrew.org with the subject line Data Protection Enquiry.

2. What personal information we collect

The information we collect depends on how you interact with us.

2.1 Information you provide directly

When you contact us, complete a form, join a programme or participate in an activity, we may collect:

• Your name, age or date of birth, and contact details.

• Your address, email address and telephone number.

• The name and contact details of parents, carers or emergency contacts.

• Your relationship to a child or young person.

• Information about your interests, support requirements or reasons for contacting us.

• Programme, workshop, membership and event registration details.

• Booking information, attendance and participation records.

• Communications you send to us, including emails, messages and enquiries.

• Feedback, survey responses and testimonials.

• Information required to manage volunteering, recruitment, partnerships or other involvement with our organisation.

We only ask for information that is relevant and necessary for the particular purpose.

2.2 Information about children and young people

When providing support, activities or programmes for children and young people, we may need to collect additional information, including:

• The child’s name, age and relevant contact information.

• Parent or carer details and appropriate permissions.

• Emergency contact information.

• Educational circumstances or support requirements.

• Special Educational Needs and Disabilities (SEND).

• Accessibility, communication or reasonable adjustment requirements.

• Relevant health, medical, allergy or wellbeing information.

• Information needed to support safe participation in an activity.

• Attendance, progress, achievements and participation records.

• Safeguarding concerns or incident information, where necessary.

We recognise that children’s personal information requires particular care and protection.

We will only collect information that is relevant to supporting the child or young person, providing a safe environment or meeting our legal and safeguarding responsibilities.

2.3 Sensitive personal information

Some information may be classed as special category personal data under the UK GDPR.

This can include information concerning physical or mental health, disability, racial or ethnic origin, religious beliefs or other legally protected categories of sensitive information.

We may process such information where it is necessary to provide appropriate support, make reasonable adjustments, protect an individual’s wellbeing or meet safeguarding responsibilities.

Special category data is subject to additional protections. We will only process it where we have both a lawful basis under Article 6 of the UK GDPR and a valid condition under Article 9, together with any applicable requirements under the Data Protection Act 2018.

Depending on the circumstances, this may include explicit consent or a condition relating to substantial public interest, such as safeguarding children and individuals at risk.

Where a substantial public interest condition requires an appropriate policy document and additional safeguards, these must be in place.

2.4 Information collected through our website

When you visit our website, certain technical information may be collected automatically, including:

• Your IP address.

• Browser type and device information.

• Operating system and general device settings.

• Pages visited and the time spent on them.

• How you reached our website.

• Website interactions and navigation activity.

• Technical diagnostic information and error reports.

• Cookie preferences and relevant consent records.

Some of this information is collected through our website hosting platform and essential website technologies. Additional analytics information is collected only where the applicable legal requirements are met.

3. How we collect your information

We may collect personal information when you:

• Complete a contact, enquiry or registration form on our website.

• Contact us by email, telephone, social media or in person.

• Enquire about support, advice, guidance or educational opportunities.

• Register for a programme, workshop, event or community activity.

• Sign up for our newsletter or other communications.

• Take part in a project, interview, production or filming activity.

• Apply to volunteer, work or collaborate with us.

• Submit feedback, testimonials or other content.

• Visit or interact with our website.

We may also receive relevant information from third parties, including parents, carers, schools, local authorities, healthcare or support professionals, community partners and referral organisations.

Where we receive information from another organisation, we will take appropriate steps to establish that it has been shared lawfully and that we have a lawful basis to use it.

We will provide relevant privacy information as required by law, subject to any applicable exemptions.

4. Why we use your personal information

We use personal information for the following purposes:

4.1 Responding to enquiries and requests for support

To respond when you contact us, answer questions, provide information about our activities, arrange further conversations and help direct you towards relevant services or support.

4.2 Delivering programmes and services

To register participants, organise sessions, deliver workshops, manage memberships, coordinate activities, communicate with parents and carers, and provide appropriate support.

4.3 Supporting accessibility and inclusion

To understand relevant individual needs, make reasonable adjustments, provide accessible activities and help ensure our programmes are inclusive and appropriate.

4.4 Protecting participants and safeguarding

To identify, record, assess and respond to safeguarding concerns, protect children and adults at risk, manage incidents and cooperate with appropriate agencies.

4.5 Managing events and creative projects

To administer events, coordinate attendance, manage bookings, plan projects and communicate important participation information.

4.6 Communicating with our community

To send relevant service information, programme updates, requested communications and, where permitted, newsletters or promotional messages.

4.7 Improving our website and services

To understand website performance, identify technical problems, review user feedback and improve the accessibility, navigation and usefulness of our website and programmes.

4.8 Meeting legal, administrative and operational obligations

To maintain appropriate records, manage finances and partnerships, respond to lawful requests, handle complaints and comply with legal or regulatory requirements.

We will not use personal information for unrelated purposes without establishing an appropriate lawful basis and providing any required additional information.

5. Our lawful bases for processing information

UK data protection law requires us to have a valid legal reason for using personal information.

Depending on the circumstances, we may rely on the following lawful bases:

Consent

Where you have given us a freely made, specific and informed choice to use your information for a particular purpose, such as subscribing to optional marketing communications or agreeing to certain uses of photographs.

Contract

Where processing is necessary to provide a service under a contract with you, or to take steps you have requested before entering into that contract.

Legal obligation

Where we must process information to comply with a legal requirement.

Legitimate interests

Where processing is necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include responding to enquiries, running our organisation effectively, protecting our systems, developing our services and maintaining appropriate communications with our community.

When relying on legitimate interests, we consider the impact on individuals, particularly children and people who may be vulnerable.

Vital interests

Where processing is necessary to protect someone’s life.

Recognised legitimate interests

Where applicable, we may rely on a recognised legitimate interest provided for by UK data protection law, including certain necessary and proportionate safeguarding activities.

We assess the appropriate lawful basis for each processing activity. We do not rely on consent for every activity, and we may be required or permitted to retain or share certain information even if consent is withdrawn.

6. Children, young people and safeguarding

Safeguarding is a fundamental part of our work.

We are committed to protecting children and young people and handling information about them responsibly, respectfully and proportionately.

We will take particular care when collecting, storing, accessing or sharing information relating to children and vulnerable individuals.

Where appropriate, we will seek permission from a parent or person with parental responsibility, while also taking account of the young person’s age, understanding, capacity and rights.

We aim to explain how information will be used in clear, accessible and age-appropriate language.

Sharing information for safeguarding

In certain circumstances, we may need to share personal information without obtaining consent.

This may happen where sharing is necessary and lawful to:

• Protect a child or adult at risk from harm.

• Respond to a serious safeguarding concern.

• Prevent or detect serious unlawful activity.

• Protect someone’s life or physical safety.

• Comply with a legal obligation.

• Make an appropriate safeguarding referral to a relevant authority.

Recipients may include local authority children’s services, adult safeguarding services, the police, emergency services or other relevant safeguarding professionals.

Any disclosure will be considered carefully, documented where appropriate and limited to information that is necessary and proportionate.

We cannot promise absolute confidentiality where someone’s safety or wellbeing may be at risk.

However, safeguarding concerns will be treated sensitively and access to related records will be restricted to those with a legitimate need to know.

Our separate Safeguarding Policy provides further information about our safeguarding procedures.

Safeguarding concerns can be sent to safeguarding@underdogcrew.org.

7. Contact forms, enquiries and registrations

Our website includes forms that allow visitors to contact us, request information, register interest in activities and subscribe to communications.

When you submit a form, we use the information provided to understand and respond to your enquiry or request.

For example, if you enquire about a workshop, family support activity or youth programme, we may use your details to contact you about that specific opportunity.

Submitting a general contact form does not automatically mean you have agreed to receive marketing emails.

Where we offer an optional marketing subscription, we will seek consent or otherwise ensure that the communication is permitted under applicable electronic marketing rules.

Please avoid including unnecessary sensitive personal information in general website forms. If more detailed information is required, we will explain how it should be provided securely.

If you choose not to provide information that is necessary for a particular activity, we may be unable to process your request or safely provide the relevant service. We will explain this where appropriate.

8. Newsletters, marketing and community updates

We may occasionally send communications about:

• Upcoming workshops, programmes and events.

• Community projects and creative opportunities.

• Volunteering and opportunities to get involved.

• Organisational news, achievements and announcements.

• Fundraising activities and ways to support our work.

• Other relevant activities offered by The Underdog Crew CIC.

Where consent is required for electronic marketing, we will ask you to actively opt in.

We will not treat an enquiry about support as automatic consent to receive promotional communications.

You can unsubscribe from marketing emails at any time using the unsubscribe link in the communication or by contacting hello@underdogcrew.org.

Withdrawing marketing consent will not prevent us from sending necessary operational communications about programmes or activities you are participating in.

We do not sell personal information or mailing lists to advertisers.

9. Cookies, analytics and website improvement

Our website uses cookies and similar technologies.

Cookies are small text files stored on your device that help websites function correctly, remember preferences and, where enabled, understand visitor activity.

9.1 Essential cookies

Some cookies are necessary for the basic operation, security and functionality of our website.

These may support:

• Website security and fraud prevention.

• Session management.

• Website navigation and functionality.

• Remembering cookie preferences.

• Access to requested website features.

These technologies may operate without consent where a relevant legal exception applies.

9.2 Analytics and performance technologies

We may use website analytics technologies to understand how visitors use our website and identify areas that need improvement.

This may include information such as pages visited, navigation patterns, approximate visit duration and technical performance.

We will provide appropriate information and obtain consent where required, or meet the conditions of an applicable legal exception.

9.3 Hotjar and visitor behaviour analysis

We may use Hotjar, a website experience analytics service, to better understand how visitors interact with our website.

Where Hotjar is enabled, it may provide features such as:

• Heatmaps showing how visitors interact with pages.

• Aggregated information about clicks and navigation.

• Session recordings that help identify usability problems.

• Feedback tools and surveys.

• Information about how well website features perform.

The purpose of using Hotjar would be to improve our website’s accessibility, usability and overall visitor experience.

If we introduce Hotjar, we will configure it with appropriate privacy protections and obtain the necessary cookie or tracking consent before activating relevant non-essential technologies.

We will take steps to prevent sensitive information, including personal details entered into forms, from appearing in session recordings or analytics reports.

Hotjar is not intended to record private conversations, safeguarding disclosures, medical information or information about children submitted through our forms.

For further information about Hotjar, please visit https://www.hotjar.com/legal/policies/privacy/.

9.4 Managing cookies

You can manage or withdraw your cookie choices using the cookie settings available on our website, where provided.

You can also use your browser settings to block or delete cookies.

Blocking certain essential cookies may affect the functionality of some website features.

We will make available further details of the cookies and similar technologies in use, including their purposes and providers, through our website’s cookie information or consent management facility.

10. Photographs, video recordings and creative projects

Photography, filmmaking, storytelling and other forms of creative media are important parts of our organisation’s activities.

During events, workshops and creative projects, photographs, audio recordings or video footage may be created.

Depending on the activity, these materials may be used for:

• Educational and creative projects.

• Recording participation and achievements.

• Internal project documentation.

• Project portfolios and showcases.

• Community updates, reports and impact stories.

• Promotional materials and social media, where appropriately authorised.

• Films, productions, exhibitions or public screenings.

We recognise that images and recordings, particularly those involving children, require additional consideration.

Where consent is the appropriate lawful basis, we will obtain suitable permissions before using identifiable images or recordings for optional publicity or promotional purposes.

For children and young people, we will take account of safeguarding considerations, age, capacity, the young person’s wishes and appropriate parent or carer permissions.

Participation in a support programme will not, by itself, be treated as permission for identifiable images to be published for promotional purposes.

Where filming or photography forms an essential part of a specific creative production, we will explain the relevant arrangements, legal basis, permissions, intended distribution and any limitations on withdrawal separately.

You can contact us if you have questions or concerns about the use of an image or recording. We will consider requests in accordance with applicable law, existing permissions and any relevant legal or contractual obligations.

11. Who we may share information with

We do not sell personal information.

We only share personal information where there is an appropriate reason and a valid legal basis to do so.

Depending on the circumstances, this may include sharing with:

Our staff and authorised volunteers

Individuals who require relevant information to organise or deliver our services, subject to appropriate confidentiality and access controls.

Educational and support organisations

Schools, local authorities, referral partners and other professionals where sharing is necessary, lawful and appropriate for the support being provided.

Safeguarding authorities

Children’s services, adult safeguarding teams, police, emergency services and other appropriate agencies where disclosure is necessary for safeguarding or legal purposes.

Technology and service providers

Organisations that provide services such as website hosting, form processing, email delivery, secure data storage, booking administration or website analytics.

Professional advisers and regulatory bodies

Accountants, legal advisers, insurers, regulators or other professional bodies where information is required for a legitimate operational or legal purpose.

Funders and project partners

Where needed to administer or evidence funded activities, subject to an appropriate lawful basis.

Wherever practical, we aim to provide anonymous or aggregated information for statistical, funding or impact reporting rather than information that identifies individual participants.

We require service providers processing personal information on our behalf to provide appropriate data protection and security safeguards.

Information will not be shared more widely than is necessary for the relevant purpose.

12. How we protect your information

We take the security and confidentiality of personal information seriously.

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss, alteration, misuse or disclosure.

These measures may include, as appropriate:

• Restricting access to authorised individuals.

• Using secure accounts and authentication controls.

• Protecting electronic records and devices.

• Securely managing sensitive or safeguarding records.

• Training or briefing relevant team members on confidentiality.

• Using reputable technology and storage providers.

• Reviewing access permissions and information-handling practices.

• Securely disposing of information that is no longer needed.

We take additional care with information concerning children, health, disability and safeguarding.

Although no electronic system can be guaranteed to be completely secure, we take reasonable and proportionate steps to reduce risks and respond to suspected data security incidents.

Where required by law, we will report relevant personal data breaches to the Information Commissioner’s Office and notify affected individuals.

13. How long we keep information

We only keep personal information for as long as it is reasonably necessary for the purposes for which it was collected, including any relevant legal, safeguarding, contractual or regulatory obligations.

Different types of information may need to be kept for different periods.

General enquiries

We retain enquiry information while responding to and managing the request and for an appropriate period afterwards where follow-up, record-keeping or the establishment or defence of legal claims requires it.

Programme and participation records

We retain information while administering the relevant activity and for any subsequent period required for safeguarding, funding, insurance, contractual, legal or operational purposes.

Safeguarding records

Safeguarding information may need to be retained for longer periods because of the nature of the concerns involved, applicable guidance and the possibility of future investigations or claims.

Marketing information

We retain subscription details while you remain subscribed. If you unsubscribe, we may retain a minimal suppression record to ensure that your request is respected.

Website information

Technical logs, cookie records and analytics information are retained according to their purpose, the applicable technology settings and our relevant retention arrangements.

Financial and administrative records

We retain records for periods required by applicable accounting, taxation, contractual and legal obligations.

Retention decisions take account of the nature and sensitivity of the information, the purpose for which it is held, legal requirements and any relevant risk to individuals.

At the end of the applicable retention period, information will be securely deleted, anonymised or otherwise appropriately disposed of.

You may contact us to ask about the retention period or criteria applicable to particular information we hold about you.

14. International transfers of personal information

Some technology providers we use may store or process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place as required by UK data protection law.

Depending on the destination and provider, these may include:

• Transfers to countries covered by UK adequacy regulations.

• Appropriate contractual safeguards, such as the UK International Data Transfer Agreement or a relevant UK Addendum.

• Other lawful transfer mechanisms, where permitted.

We will also consider any additional measures needed to protect the information.

You can contact us to request further information about relevant international transfers and safeguards.

15. Your data protection rights

Under UK data protection law, you have rights relating to how your personal information is used.

Depending on the circumstances and applicable legal exemptions, these may include:

The right to be informed

To understand what personal information we collect and how we use it.

The right of access

To request a copy of personal information we hold about you.

The right to rectification

To ask us to correct inaccurate information or complete incomplete information.

The right to erasure

To request deletion of personal information in circumstances where the law provides this right.

The right to restrict processing

To ask us to limit the use of your information in certain circumstances.

The right to data portability

To receive certain information in a structured, commonly used and machine-readable format, where this right applies.

The right to object

To object to processing based on certain lawful grounds, including direct marketing.

Rights relating to automated decision-making

To benefit from applicable protections where decisions are made solely by automated means and have legal or similarly significant effects.

We do not intend to use solely automated decision-making that produces legal or similarly significant effects when determining access to our support programmes.

The right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

Some rights are subject to exemptions or limitations, particularly where information must be retained for legal or safeguarding purposes.

Exercising your rights

To exercise a data protection right, please email:

hello@underdogcrew.org

Subject: Data Protection Request

Please provide enough information for us to identify the relevant records and understand your request.

We may request reasonable verification of identity where necessary.

We will respond within the time limits set by applicable data protection legislation, normally within one month for a data subject rights request, subject to any lawful extension.

There is normally no charge for exercising your rights.

16. Children’s privacy rights

Children and young people have their own data protection rights.

We recognise the importance of helping young people understand how their information is collected and used.

Where appropriate, we will explain privacy information in a way that is accessible and suitable for the young person’s age and understanding.

Parents and carers may be able to make requests on behalf of a child where they have the appropriate authority and it is lawful and appropriate to do so.

We will consider the child’s capacity, wishes, confidentiality and best interests when responding to requests involving their personal information.

We will not automatically disclose a young person’s confidential information to a parent or carer simply because they request it.

Where consent for an online service requires parental authorisation under applicable law, we will take appropriate steps to obtain and verify that authorisation.

17. External websites and third-party services

Our website may include links to external organisations, resources, social media platforms, videos or other websites.

These third-party services may operate under their own privacy policies and data protection arrangements.

We encourage visitors to review the privacy information provided by external services before submitting personal information.

This Privacy Policy does not govern how independent third parties handle information on websites or services that they control.

Where third-party content embedded on our website uses cookies or similar tracking technologies, we will apply the relevant privacy and cookie requirements.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, services, technology, legal responsibilities or data protection practices.

When changes are made, we will update the revision date at the top of this page.

Where changes significantly affect how personal information is processed, we will take appropriate steps to inform affected individuals where required.

We encourage visitors to review this policy periodically.

19. Questions, concerns and complaints

We want you to feel confident about the way your information is handled.

If you have a question, concern or complaint about our privacy practices, please contact us in the first instance.

The Underdog Crew CIC

Registered office: 90 Goring Road, Colchester, England, CO4 0DA

Email: hello@underdogcrew.org

Website: https://www.underdogcrew.org

Please include Data Protection Complaint in the subject line if your enquiry is a formal complaint about our handling of personal information.

We will provide an accessible way to raise a complaint, acknowledge data protection complaints within 30 days, investigate them appropriately and inform you of the outcome without undue delay.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office

Website: https://ico.org.uk

Telephone: 0303 123 1113

You may also have the right to seek a judicial remedy.

Our promise

At The Underdog Crew, trust is at the heart of everything we do.

People come to us to find opportunities, connection, support and a place where they belong. We recognise that sharing personal information can require considerable trust, especially when it concerns children, families or personal circumstances.

We are committed to treating that information with the care, dignity and respect it deserves.

Your story matters. Your privacy matters. And your trust matters.

The Underdog Crew CIC — Empowering, Supporting, Nurturing and Changing Lives.