1MM General Privacy Notice 

 

One Million Mentors (1MM) may update this Privacy Notice periodically, this version has been updated March 2026. We encourage you to review this page regularly to stay informed about any changes and ensure you are comfortable with them.

We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (hereafter referred to as UK GDPR) and the Data Protection Act 2018 (hereafter referred to as DPA). This notice explains what data we collect, how we store it, and how we use it and the lawful basis we rely on for doing so this includes any information we may have already collected before you read this notice. 

The One Million Mentors Platform and One Million Mentors Website  is operated by One Million Mentors, registered address St James Tower, Charlotte Street, Manchester, M1 4DZ | Company No. 08252639 | Charity No. 1149905 | ICO Registration reference: ZA095682 

 

Our role:

One Million Mentors acts as a data controller for the majority of the processing described in this notice. In some cases, we may act jointly with partner organisations (such as youth partners) where responsibilities are shared.

 

One Million Mentors Services:  

This privacy notice applies to your use of 1MM’s website (onemillionmentors.org.uk), and the 1MM online mentoring platform (collectively referred to as the “1MM services”) and forms part of our terms and conditions. 

 

User agreement: 

If you’re a mentee, mentor or coordinator (we call you “platform users”) on 1MM’s online mentoring platform. As a platform user, when registering your online mentoring account, you will need to acknowledge that you have read and understood this privacy notice. 

 

Contact us:  

If you have questions or concerns about this privacy notice, or if you object to One Million Mentors processing your personal data, please contact dataprotection@1MM.org.uk, marked: FAO Data Protection. 

 

Where we collect your information from:  

Information you share with us: We may obtain personal information from you when, for example, you sign up for one of our programmes, apply to become a volunteer, take part in an event, make a donation, fill out one of our surveys, or join our mailing list. It can also include information provided through other means, such as emails, video, phone calls, or during meetings with us. 

Information from Third Parties: Sometimes, we receive information about you from independent third parties, but only where they are permitted to share it with us. For example, a youth partner might pass along your information. You should check their privacy notice when you provide your information to understand how they handle your information. Once we get it, it will be covered by our privacy notice as well as by the originating third party. 

Information we get from your use of our website and services: We collect information about the services you use and how you use them, for example, when you visit our websites, or view and interact with our ads and content. 

Information in the public domain: We may obtain some information from publicly available sources such as Companies House, newspaper articles or open postings on social media such as Facebook, X, YouTube and LinkedIn. This is not an exhaustive list of the public sources. 

 

What kind of information we collect and how we use it: 

Data Category	Sub-Category
Technical	IP Address, Browser, Device
Contextual	Traffic Source (Google, Facebook)
Personal	Name, Email, Form Data
Behavioral	Clicks, Page visitor

 

Category of personal data	Examples	Purpose of processing	Lawful basis	Special category condition (where applicable)
Personal contact details	Name, postcode, email address, telephone number	Account creation, communication, service delivery	Contract; Legitimate interests	N/A
Demographic information	Age, gender, race, interests	Programme delivery, monitoring participation, improving services	Legitimate interests	Explicit consent (where sensitive data is collected)
Biographical details	Employment history, education history, DBS checks	Matching mentors/mentees, safeguarding, programme suitability	Legitimate interests; Legal obligation (DBS)	Substantial public interest (safeguarding); Legal obligation
Service usage data	Progress data, platform usage, engagement metrics	Service improvement, analytics, reporting	Legitimate interests	N/A
Financial data	Payment card details, donation history	Processing donations and financial administration	Contract; Legal obligation	N/A
Special category data	Health data, disability, ethnicity	Safeguarding, programme support, equality monitoring	Legitimate interests; Consent	Explicit consent; Substantial public interest (safeguarding)
Criminal conviction data	DBS checks, criminal background information	Safeguarding and suitability assessments	Legal obligation; Legitimate interests	Substantial public interest (safeguarding)
Behavioral Data	Clicks, page per visit	Understand usage patterns, improve functionality and performance, and inform product development and user experience.	Consent	N/A

Lawful basis summary
Lawful basis	When we use it
Consent (Article 6(1)(a))	Marketing communications, research participation, media usage
Contract (Article 6(1)(b))	Providing access to and operating the mentoring platform
Legal obligation (Article 6(1)(c))	Safeguarding duties, employment and payroll obligations
Legitimate interests (Article 6(1)(f))	Service delivery, communications, analytics, safeguarding monitoring,

Special category data
Type of data	Condition relied upon
Health, disability, ethnicity	Explicit consent (Article 9(2)(a))
Safeguarding-related data	Substantial public interest (DPA 2018)

 

Sharing your information 

We will not share your personal information with anyone outside of 1MM, other than:

• contracted partners

• mentoring coordinators

• mentors/mentees

• service providers (e.g. hosting, analytics, CRM systems)

• evaluators and research partners (where applicable)

• regulators or law enforcement where required by law

All third parties are required to process personal data in accordance with contractual safeguards.

 

Safeguarding 

In exceptional circumstances where a mentor or mentee is deemed to be at risk of significant harm or to have suffered significant harm, or to be a danger to another person, mentoring confidentiality may have to be broken. 

In circumstances such as these, the mentee or mentor will be informed of our intended action, or in exceptional circumstances the action may already have been taken before the mentee or mentor can be informed.  

In addition, 1MM reserves the right to use or disclose any personal information as needed to satisfy any law, regulation or legal request, to protect the integrity of the 1MM services, to fulfil your requests, or to cooperate in any law enforcement investigation. 

We may share personal data where necessary to:

• protect an individual from harm
• comply with safeguarding obligations
• cooperate with law enforcement or regulatory bodies

See here for our Safeguarding Commitment   

How we keep your information safe 

We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption where appropriate, and staff training.

In order to prevent unauthorised access or disclosure, we use a password protected CRM system to safeguard and secure the information we collect online.  

All staff and volunteers who may handle personal data are given an induction appropriate to their role and training in the systems and policies of One Million Mentors, including periodic refresher training and reminders. 

 

How long we keep your personal information for 

We retain personal data only as long as necessary for the purposes described.

Typical retention periods include:

• mentoring and programme data: up to 10 years from end of relationship

• safeguarding records: 2–20 years depending on severity

• financial and payroll data: up to 10 years

• recruitment data: up to 2 years

Retention periods may be extended where required by law or safeguarding obligations.

How we use information for marketing

We may contact you by email or text message to provide updates about our work, fundraising activities, events, and opportunities to support our charitable purposes. Where you have engaged with our charity (for example by making a donation, volunteering, registering for an event, requesting information, or otherwise expressing an interest in our work), we may rely on the “soft opt-in” under the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025, to send you these communications. This means we can contact you where: You have shown an interest in or supported our charitable purposes; and we gave you a clear opportunity to opt out when we collected your details. We will always ensure that our communications are relevant to our charitable purposes and we will provide a simple and free way for you to opt out in every message you receive.   Your choices You can opt out of receiving marketing communications from us at any time by:

• clicking the “unsubscribe” link in any email;
• replying STOP to any text message; or
• contacting us using the details set out below.

We will respect your preferences and maintain a suppression list to ensure you do not receive further marketing communications once you have opted out.   Important information We will only rely on this soft opt-in where your contact details were collected on or after 5 February 2026 in line with the updated legal requirements. In other cases, we will rely on your consent or another appropriate lawful basis where required.  

How we use Cookies 

Cookies are small blocks of data that are placed on your computer by the websites you visit. They enable web servers to store information about your usage on the website. 

We also use Google Analytics to provide us with statistical data on how people use this site. Google Analytics cookies are third party cookies set by Google, which include both session and persistent cookies. 

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.  To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout. 

 

Third party tools 

onemillionmentors.org.uk
Third Party	Purpose	Data Collected/Processed	Opt-Out Options
Google Analytics	Website usage analytics	IP address (anonymized), page visits, device/browser info	Disable cookies or use browser opt-out
Social Media Plugins	Optional social sharing	May collect user data if users interact with embedded social buttons	Manage via social media privacy settings
Web Hosting Provider	Website hosting and performance	Server logs, IP addresses, website performance data	N/A
Eventbrite	Manage training event registrations	Name, email, registration details	Manage directly through Eventbrite account
Email Marketing (Bitrix)	Newsletters and updates	Name, email address	Unsubscribe link in emails
Payment Processing (Enthuse)	Handle donations and payments	Name, email, payment details	Processed securely; users may contact us for deletion requests
1MM’s Mentorship Platform
Third Party	Purpose	Data Collected/Processed	Opt-Out Options
Chronus	Mentoring platform	Profile data, mentoring activities, communications	Account deletion upon request
Web Hosting Provider	Hosting Chronus platform	Server logs, performance data	N/A
CRM (Salesforce/Bitrix)	Program management	Names, contact details, limited program data	Contact delivery team for data inquiries
SMS (ClickSend)	SMS notifications	Phone number, message content	Opt-out via SMS reply or contact delivery team
Security/Storage Providers	Data protection and storage	Encrypted stored data, access logs	N/A

We also use internal analytics and reporting tools such as Google Analytics, BigQuery and Microsoft Power BI to analyse programme data. 

Where cookies or similar technologies require consent under PECR, we will only place them on your device after obtaining your consent through our cookie management tool. All third-party providers processing personal data on our behalf act as data processors and are subject to contractual obligations under Article 28 UK GDPR.

Third party sites 

This privacy notice applies specifically to 1MM services and does not cover your internet activities beyond this website. This includes websites you access through links on our services, whether this be a youth partner, an educational resource, or a news article (this is not an exhaustive list). We recommend reading the privacy statements of other websites you visit through 1MM services to understand their data practices. 

 

International Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as adequacy regulations or Standard Contractual Clauses (SCCs).

Your data protection rights 

Under the GDPR, you have the following rights in relation to your personal data: 

• Right to be informed (about what data we process, how we process it, why we process it and other key information) 
• Right to request a copy of the information we hold about you 
• Right to edit and update your information 
• Right to request to have your information erased 
• Right to restrict processing of your information  
• Right to object to processing of your information – including automated decision making and profiling 
• Right to data portability 

If you wish to exercise your rights, please address your request, by email to dataprotection@1MM.org.uk, marked: FAO Data Protection in the subject heading or submit your request using this form. To help us locate information about you (or in case we need to get in touch with you to obtain further information to help us locate your records), please include your full name, address, and date of birth with your request. 

We may need to verify your identity before responding to your request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”) (the UK data protection regulator).  For further information on your rights and how to complain to the ICO, please refer to the ICO website and 1MM’s ICO Registration reference: ZA095682 

Contact information and review If you would like to discuss anything in this document, please contact:

Position	Name	Email
CEO	Alveena Malik	alveena.malik@1mm.org.uk