Privacy and Data Protection Policy

Introduction

Futuwwah Scouts CIC is a registered Community Interest Company in England (Registered No. 16272014) established in 2025 to nurture the character and holistic development of children and young adults by developing age-appropriate non-formal education programmes and materials which merge key aspects of the international scouting and girl guide movement within an Islamic ethos and framework, based on the futuwwah tradition.

We provide training and consultancy services to help new groups become established; ongoing

guidance, training and support to established groups; and produce programme materials and supplementary resources for leaders and children of different age sections which are available to members worldwide. We do not directly operate or manage local Futuwwah Scout Groups (Futuwwah Clubs in the US).

Futuwwah Scout CIC is committed to protecting and respecting your privacy and the privacy of its members. This commitment underpins both our Data Protection Policy and other associated policies used by local Futuwwah Scouts in their respective countries, and their membership.

Futuwwah Scouts (Futuwwah Clubs in the US) operates with three membership models: Independent Groups, Organisation-Sponsored Groups, and Family Pods.

Each Local Futuwwah Scout Group, Club, or Family Pod process their own data, separate from Futuwwah Scouts CIC, and are separate entities. This means they are directly responsible for any personal data they process, and must be informed of their responsibilities under the laws of their own states or countries. We provide general guidance to local groups.

If you have any questions about this Data Protection Policy or how we handle your data, please contact us at: privacy@futuwwahscouts.org.

1. Purpose of this Data Protection policy and what it covers

This policy sets out Futuwwah Scouts CIC’s approach to protecting personal data and explains individuals’ rights in relation to how we process personal data. We provide more detail about how we process and protect personal data below, in particular in section 5. 

Futuwwah Scouts CIC (“We” in this document) is registered with the UK’s Information Commissioner’s Office. If you have any questions about this policy or your own rights, please email: privacy@futuwwahscouts.org.

We may make minor changes to this policy from time to time. We will notify our members when any significant changes to the policy are made.

2. Definitions

‘We’ means Futuwwah Scouts CIC.

‘ICO’ is the Information Commissioner’s Office, which is responsible for data protection legislation in the UK and the regulatory authority for the GDPR (General Data Protection Regulation).

‘Local Futuwwah Scout Group or Club’ and ‘Family Pod’ mean independent, organisation-sponsored or family-based scout groups in the UK or abroad.

‘Independent Futuwwah Scout Group’ means a group that is not sponsored by or affiliated with another organisation or community group, and who operate as a separate legal entity, e.g. charity or community organisation, according to the laws of their country.

‘Organisation-Sponsored Group’ means a group that exists under the umbrella of, or as an extension of, a religious, charitable or community organisation which is its own legal entity, and which offers the Futuwwah Scouts programme as part of its youth activities.

‘Family Pod’ means a small group of young people from one or two families or homeschooling pods who participate in the Futuwwah Programme under the guidance and responsibility of their parents.

‘Personal Data’ is defined in Section 3.

‘Processing’ means all aspects of handling personal data, for example collecting, recording, keeping, storing, sharing, archiving, deleting and destroying it.

‘Data Controller’ means anyone (a person, people, public authority, agency or any other body) which, on its own or with others, decides the purposes and methods of processing personal data. We are a data controller because we process personal data in the ways described in this policy.

‘Data processor’ means anyone who processes personal data under the data controller’s instructions, for example a service provider. We act as a data processor in certain circumstances.

‘Subject Access Request’ is a request for personal data that an organisation may hold about an individual. This request can include the deletion, correction and restriction of processing.

3. What is personal data?

Personal data means any information about an identified or identifiable person. For example, an individual’s home address, personal (home and mobile) phone numbers and email addresses, occupation, and so on can all be defined as personal data.

Some categories of personal data are recognised as being particularly sensitive (“special category data”). These include data revealing racial or ethnic origin, political opinions, and religious or philosophical beliefs.

4. How does data protection apply to local Futuwwah Scout Groups, Clubs or Pods?

Data protection legislation applies to all data controllers in the UK under the GDPR (General Data Protection Regulation), whether or not they are charities or small organisations. It applies to local groups in the same way as it does to other organisations.

• Independent Local Futuwwah Scout groups operate as independent organisations, and since they collect and store personal data about members and young people, they are data controllers and responsible accordingly.
• Organisation-Sponsored Futuwwah Scout Groups operate under the umbrella of their sponsoring organisation, which is responsible for ensuring that they comply with data protection legislation.
• Family Pods are exempt from GDPR legislation, as they operate as home education curriculum and/or home-based clubs and thus fall under the category of “data processing primarily for personal/household activities”. However, Futuwwah Scouts CIC advises all Family Pods to take sufficient steps to protect the data and privacy of their children and household.

Data protection laws in Europe are similar to that of the UK. Laws in other countries differ, and our members are asked to seek legal guidance about the requirements where they live.

For the purpose of membership, both Futuwwah Scouts CIC and local Scout Groups, Clubs and Pods act as independent data controllers. This relates to:

• Maintenance of primary records, such as name, address and leadership details of the local Group.
• Local roles, such as the creation, management and deletion of role and any reasons for leaving local Scouting. This includes ID checking.
• Direct messaging in an online platform or communication app.
• Training, learning and permit management.

Each Futuwwah Scout Group, Club or Pod will have its own data protection policy. For questions, you should contact the group directly.

5. What type of personal data do we collect and why?

5.1 Members and volunteers

We hold personal data (including special category data) about adult members and volunteers on our database. Information we hold about members may include:

• name and contact details
• length and periods of membership and volunteer service
• details of training received
• details of experience, qualifications, occupation, skills and awards received
• details of events and activities members have taken part in
• details of next of kin
• age/date of birth
• legal sex
• details of any health conditions
• details of disclosure (police) checks
• any complaints we have received about the member
• details of any safeguarding (child protection) concerns raised about or by the member
• details about role(s) in Futuwwah Scouts
• details about membership status

We need this information to communicate with members and to carry out any necessary checks to make sure that members can work with young people.

Much of this information is collected from the member joining forms or is input directly into the system by members themselves.

5.2 Young People

We do not hold a youth membership database; this responsibility lies with the local Groups. However, we do process some personal data about Young People.

• For Young People, we hold information if there has been a safeguarding or safety case raised, and this may include basic personal identifiers along with the details of the case.

• We may capture information on Young People who attend events managed by Futuwwah Scouts, which may include details on dietary needs and accessibility requirements.

• We process data about Young People where they have been put forward for an award, entered a competition run by Futuwwah Scouts CIC, or participated in research organised by Futuwwah Scouts CIC.
• We also process data on Young People where they are part of a legal claim, including the detail of the claim itself.

5.3 Directors and members of the governance and advisory structure

For Futuwwah Scouts CIC’s Board of Directors and its subcommittees, Advisory Group, other committees and working groups, we may hold the type of information as set out in 5.1 and including the following:

• CVs
• Related information

5.4 Donors

We benefit from donations from members of the public who support our work. We hold personal data about our donors so that we can process donations and tell donors about our work, campaigns and how they can support us further. This may include details of donors that wish to leave a legacy in their will. 

We hold the following types of information:

• name and contact details
• address
• details of donations and interactions, such as communications and events

Where Futuwwah Scouts CIC have assessed individuals as a major donor, we may hold publicly available details that assist us in assessing:

• capacity to give
• propensity to give
• alignment with Futuwwah Scouts’ aims and ethos

5.5 Customers and visitors

We also hold personal data for visitors to our sites. This can include guests, suppliers, tradespeople and contractors. We may hold the type of information as set out in 5.1. Much of this information is taken from online registration forms, and sign-in mechanisms. 

5.6 Employees and contractors (past, present and future)

As an employer, we need to keep information relating to each member of staff and contractors who have a contract with us. This includes the pre-employment stage, references, and records relating to the time they worked for us including probationary, appraisal and disciplinary information.

We have a separate Employee Privacy Notice which provides more detail to staff members about how we process their data. 

6. Conditions for collecting personal data

6.1 Compliance with the law

We must comply with UK law when processing personal data. To do this, we must meet at least one of the following conditions:

• Consent– to give (or have given) permission for us to use their information for one or more specific purposes.
• Performance of a contract– we need to process the information to meet the terms of any contract we have entered into.
• Legal obligation– processing the information is necessary for us to comply with our legal obligations as a data controller.
• Vital interests– processing the information is necessary to protect someone’s life.
• Public task– processing the information is necessary for us to carry out a task in the public interest or to exercise authority as a data controller. 
• Legitimate interests– processing the information is necessary for our legitimate interests as an organisation (see below examples).

Also, information must be:

• processed fairly, lawfully and in a transparent manner
• collected for specified, clear and legitimate purposes
• adequate, relevant and limited to what is necessary
• accurate and, where necessary, kept up to date
• kept for no longer than is necessary
• processed securely

6.2 Who we share information with

We may need to share personal data within appropriate levels of the organisation and with local groups, provided this is necessary and directly related to a member’s role within Futuwwah Scouts. This is subject to data sharing agreements entered into with each group. 

Futuwwah Scouts CIC may also share personal data with its partners, companies, organisations and individuals who help us to fund, organise and operate events, projects, programmes and other activities. Our legal basis for this is the pursuit of our legitimate interest in working collaboratively with other organisations to operate and administer the event, project, programme or activity. 

We do not share personal data with companies, organisations or people outside of Futuwwah Scouts unless we have a lawful basis for doing so and one of the following applies:

• We have entered into a data sharing or data processing agreement with them
• We are legally required to share the information
• Sharing the information helps safeguard Young People 

We never sell personal data.

6.3 Sharing information outside the UK

Where necessary, some personal information is transferred outside of the UK, primarily for cloud-based services. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation names: IONOS, and Google cloud-based services.

Country the personal information is sent to: USA and/or Europe

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge).

7. Keeping personal data secure

We use technical and organisational safeguards to protect your data and prevent the loss, misuse or alteration of your personal information. Everyone who handles personal data makes sure it is held securely to protect against unlawful or unauthorised processing and accidental loss or damage. We take appropriate steps to make sure we keep all personal data secure, and we make all our staff aware of these steps. Our staff undertake regular training to ensure that they are aware of the above.

8. Responsibilities

We expect our staff, directors, volunteers, members and any providers we use to adhere to data protection legislation.

9. Data Retention

9.1 Data Retention Requirements

We keep information for different periods of time for different purposes as required by law or organisation requirements.

Examples: For membership information, to ensure continuity (for example if someone leaves and then re-joins) or to carry out our legal responsibilities relating to safeguarding Young People, we keep membership information after it ends, and we make sure we store it securely. Only those staff who need membership information to carry out their role have access to that information.

For a detailed explanation of how long we retain information, and why, see our Data Retention Schedule below.

9.2 Data Retention Schedule

The following retention periods are analysed into the categories of data held within Futuwwah Scouts CIC. These are as follows:

• Members’ and volunteers’ data
• Donors’ data
• Event registrants’ and participants data
• Online Store customers’ data
• Legal services
• Staff data
• Complaints, Customer Service & Communication & Whistleblowing

The retention period is applicable at the point where the relationship has finished, for example where a member has left the organisation.

The same piece of data may be held for different purposes. It will therefore be covered by the retention policy for each purpose, and so retained by the organisation for the longer of the stated periods.

Members and Volunteers’ Data

Donors’ Data

Event registrants’ and participants data

Online Store Customers’ Data

Legal Services

Futuwwah Scouts CIC Staff and Volunteer Data

Complaints, Communication & Customer Service

10. Data Subject Rights

You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification– You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure– You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing– You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing– You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability– You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent– When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you within one month.

To make a data protection rights request, please contact us at privacy@futuwwahscouts.org.

Please note that subject rights requests for data held by Local Futuwwah Scout Groups or Clubs should be made directly to the relevant group.

11. How to Complain

If you have any concerns about our use of your personal data, you can complain to us directly by emailing: complaints@futuwwahscouts.org. We will investigate and respond within one month.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Futuwwah Scouts CIC
Registered Company No: 16272014 (England and Wales)

Effective Date: 1^st September 2025

For review: September 2026