Privacy Policy

1. INTRODUCTION

This policy governs the collection, storage and use of personal data collected by The Mullany Fund through our main website www.themullanyfund.org, telephone conversations, and our normal activity of running a social mobility charity. It also describes your choices and rights in relation to this information. We are committed to ensuring high standards of data protection, privacy and confidentiality in all our activities. Personal data is collected, held and used in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations. In this policy, “personal data” means information that identifies, or could reasonably identify, a living individual.

2. WHO ARE WE?

We are The Mullany Fund, a social mobility charity that was established in 2008 with a focus on STEM and widening participation. Our aim is to give every young person the opportunity of accessing a career in STEM regardless of background. In order to meet this goal, we have developed an innovative e-Mentoring service which connects disadvantaged school children with STEM professionals and undergraduates via a secure online space for the purpose of one-to-one mentoring.
 

Our email address is office@themullanyfund.org

Our postal address is The Mullany Fund, P.O. Box 29, Swansea, SA9 5AB.

3. DATA CONTROLLERS

The Mullany Fund is the data controller and is responsible for your personal data. In this privacy policy, “we”, “us” and “our” refer to The Mullany Fund. The term “you” refers to individuals who engage with our charity in connection with our charitable objectives, including users of our website, participants in our projects, mentors, supporters, suppliers and partners.

The Mullany Fund does not appoint a formal Data Protection Officer unless required to do so, but responsibility for data protection queries rests with the charity’s nominated data protection contact, currently the Charity Manager. You can contact us about data protection or privacy matters at office@themullanyfund.org.

4. PERSONAL INFORMATION YOU PROVIDE

We will only use personal data where we have a lawful basis to do so. Depending on the activity, this may include consent, performance of a contract or agreement, compliance with a legal obligation, protection of vital interests, or our legitimate interests as a charity in delivering, improving and evaluating our services. Where we rely on consent, you can withdraw that consent at any time. Where we rely on legitimate interests, we will consider your rights and interests before using your data.

Some of the information we process may be special category data, such as health information, racial or ethnic origin, or information about beliefs, and some may relate to criminal convictions or DBS checks. We will only process this type of information where it is necessary for a specific purpose, where we have both a lawful basis and an additional legal condition for processing, and where appropriate safeguards are in place. This may include safeguarding, equality monitoring, suitability checks, or supporting participation in our projects. We will limit access to this information and will not use it for unrelated purposes. Where the Data Protection Act 2018 requires it, we maintain an Appropriate Policy Document setting out how we process special category and criminal offence data, including information from DBS checks

4.1   INDIVIDUALS ENGAGED IN OUR ONLINE E-MENTORING PROJECTS

When you take part in one of our e-Mentoring projects, we may gather and store information that you provide to us. 

This may be provided:
•    by yourself when you register for the project
•    by yourself as part of the project
•    by yourself when you complete an online survey
•   by other institutions that have contracted with the Mullany Fund to carry out an online    mentoring project with us ("Contracted Partners")
•    in any other way, for example by emailing us, telephoning us or during any meeting you may have with us.

The following categories of information are held in our databases/paper records: 

•    first and last name
•    postcode
•    mobile telephone number
•    e-mail address
•    employment or education/school
•    DBS checks where applicable
•  information in relation to age, sex, gender a person identifies as, interests and hobbies
•    information related to physical or mental health, beliefs, racial or ethnic origin or criminal convictions

4.2   INDIVIDUALS WHO JOIN OUR MAILING LIST

If you sign up to join one of our mailing lists, we will collect your name and email address, together with your consent to receive communications from us. This may include a general newsletter about our charitable activities or information about a project in which you have expressed an interest. You can withdraw your consent at any time by using the unsubscribe link in any of our email communications or by contacting us. In addition, from 5 February 2026 charities may send electronic marketing to people who have expressed an interest in, or offered support for, their charitable purposes without prior consent (the “charitable purposes soft opt-in” under the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025). Where we rely on this, we will only do so where we collected your contact details directly, you were given a clear and simple opportunity to opt out at the time we collected them, and every message we send contains an easy way to opt out. You can opt out of marketing from us at any time.

4.3    SUPPLIERS, SUPPORT ORGANISATIONS AND POTENTIAL PARTNERS

If you are, or work for, a supplier, potential supplier or partner to The Mullany Fund, then we will collect the minimum amount of business specific personal data, usually your name, business role and business contact details to enable us to manage the business relationship.

5.    PERSONAL INFORMATION CREATED WHEN YOU USE OUR SERVICES

Where we work with children and young people, we will take particular care to explain how personal data is used in a clear and age-appropriate way. We may receive information from schools, colleges, parents or carers, contracted partners, mentors, project coordinators, or the young person themselves. We will use this information only for the purposes of delivering, safeguarding, monitoring and evaluating the project, and we will take account of the age, understanding and best interests of the child or young person when handling their information. Where our online services are likely to be accessed by children, we design and operate them in line with the ICO’s Age Appropriate Design Code (the “Children’s Code”). Where we rely on a child’s own consent in relation to an online service, we will only do so where the child is aged 13 or over; for younger children we will obtain the consent or authorisation of a parent or carer, usually arranged through the child’s school, college or our Contracted Partner. Where we rely on legitimate interests in relation to children’s data, we carry out and record a legitimate interests assessment which gives particular weight to the best interests of the child.

5.1    WEBSITE ANALYTICS

We may collect information about how visitors use our website through analytics tools, such as the number of visitors to the website in a given period, the pages visited, how people arrive at our site and similar usage information. Some analytics information may involve online identifiers, such as cookie identifiers or IP addresses. We use this information to understand and improve our website. Where required, we will obtain consent before using non-essential analytics cookies. Where we use Google Analytics, Google processes this information as our service provider and some analytics data may be processed outside the UK; where this happens, appropriate safeguards are applied. You can learn more about Google Analytics or opt out if you wish. 

5.2    COOKIES AND THIRD-PARTY TECHNOLOGIES

We may use cookies, web beacons or similar technologies on our website. Some cookies may be necessary for the website to work properly, while others may help us understand website use or personalise the experience. Non-essential cookies will only be used where any required consent has been obtained. You can change your browser settings to reject cookies, although this may affect website functionality. We will provide clear information about the types of cookies we use, their purpose and how long they last. The table below summarises the cookies currently in use; the full list of individual cookies, their providers and durations is available via the cookie settings tool on our website.

6. INFORMATION WE SHARE

We will only share personal data where it is necessary for the purposes described in this policy, where we have a lawful basis to do so, or where we are legally required or permitted to share it. This may include sharing relevant information with Contracted Partners, schools, colleges, educational partners, service providers, project coordinators, safeguarding contacts, professional advisers, regulators or public authorities where appropriate.

6.1    MENTORING PLATFORM- MENTORA

We use an in-house e-Mentoring platform, Mullany Mentora. Any personal information you share when engaged in one of our e-Mentoring projects will remain in our content management system managed by Imaginet ( see below)

Where we use service providers to process personal data on our behalf, we will require them to protect the information, use it only for authorised purposes, and maintain appropriate security measures. We will keep our data sharing arrangements under review and will only share the minimum information needed for the relevant purpose. 

6.2    DATABASE- IMAGINET LTD

We use Imaginet Ltd to host our database and website.  We do this as they offer a highly secure standard of hosting, certified by Cyber Essentials. They have access to our database and website for technical and security purposes. You can learn more about Imaginet Ltd and their approach to privacy here. 

6.3    EVALUATION - EDUCATIONAL PARTNERS

In order to assess the effectiveness of our services and improve them for the future, we may monitor the progress of students after they have completed our projects. Where appropriate, and where we have a lawful basis to do so, we may provide basic information about a student to educational partners, such as UCAS or relevant schools and colleges, so that they can provide information about the student’s progress to us. This helps us evaluate our impact, improve our services and support funding applications.

6.4    EMERGENCY PROCEDURES

We may disclose personal data where this is necessary to protect a student, mentor or another person from significant harm, to respond to safeguarding concerns, to comply with a legal obligation or lawful request, to protect the rights and safety of The Mullany Fund, or to establish, exercise or defend legal claims. We will only share the information that is necessary in the circumstances.

7. HOW WE USE YOUR INFORMATION

The table below summarises how we use the personal information you provide to us. 

In brief, the personal information provided to us in the provision of our services to you or for monitoring purposes. We will only use your personal data in the following circumstances:

•    to register you with the project
•    to set up an online account for you
•    to carry out the demands of the project – for example our database is a tool to enable us to match mentors with students based on shared interests.
•    to communicate with you about the project and where you have consented, to contact you about the activities in which you have expressed an interest.
•    to give schools and colleges feedback on their engagement with the project.
•    monitoring, evaluation, and reporting purposes. Please note that information about your sex, gender, racial or ethnic origin and physical or mental health or condition will only ever be used for statistical and monitoring purposes on an anonymised basis.
•    periodically, we may request your permission to use parts of your and your mentor/mentee's journal for marketing and demonstration purposes. In these cases, we will only use materials if your express permission has been granted; we can also change names to protect your identity.
We do not use your personal information for any other purpose.

If personal data is transferred or accessed outside the UK, we will make sure that appropriate safeguards are in place where required by data protection law. This may include using service providers that offer recognised transfer safeguards or ensuring that another lawful transfer mechanism applies.

8. DATA SECURITY

Your personal information will be kept on secure servers and kept confidential by the Mullany Fund. We take steps to protect personal data, but if we become aware of a personal data breach we will assess the risk, take appropriate action to contain and investigate it, and notify affected individuals and the Information Commissioner’s Office where required by law.

8.1    SECURE STORAGE

The websites designed by The Mullany Fund will include standard security and confidentiality procedures using secure servers. The system uses its own secure communication framework in which all passwords and communications are encrypted between browsers and servers, and the website is hosted in a highly secure data centre that allows named and authorised access only. Our website security is under constant review due to the nature of computer, software and internet developments 

8.2 CONTROLLED ACCESS

Your contact details (email address, mobile phone number, school etc) will be seen only by The Mullany Fund, your project coordinator and third-party organisations which are appointed by The Mullany Fund for matters relating to project activities and evaluation of the project, parties that are contractually obliged to keep your personal data secure and confidential. All messages will also be kept private from any individuals except those listed above. From time to time, The Mullany Fund staff and your project coordinator will review all messages to protect your safety by ensuring that there is no misuse of this website or of your mentoring relationship. Only users authorised by us have access to this data. We take all reasonable measures to ensure that the information we hold is accurate. In particular we use reliable collection methods and destroy or convert to an anonymous form, any out-of-date data. 

8.3 STORAGE PERIOD

We will keep personal data only for as long as it is needed for the purposes for which it was collected, including delivering projects, safeguarding participants, meeting legal or regulatory obligations, resolving queries, maintaining records, monitoring and evaluation, and managing communications. Retention periods may vary depending on the type of information and the reason we hold it. Where information is no longer needed, we will delete it securely or anonymise it so that it can no longer identify an individual. If you ask us to delete your personal data, we will consider your request and respond in accordance with data protection law, normally within one calendar month of receiving your request. The table below summarises how long we keep the main categories of personal data; periods shown in [brackets] are proposed and should be confirmed by the trustees.

8.4 THIRD PARTY SITES

This privacy policy only relates to this website and does not extend to your use of the internet outside this website; in particular, it does not relate to any websites to which you may link using the hypertext connections within this website. The Mullany Fund is not responsible for the privacy practices of other websites. You are encouraged to read the privacy statements of other websites.

9. THINGS YOU CAN DO

9.1 CONTACT US 

If you have any questions or comments about this privacy statement or our Privacy Policy, please contact us at office@themullanyfund.org. You should also use this email address to tell us if any of your personal data changes, or if you would like to exercise any of your data protection rights, including asking to see, correct or delete information we hold about you. 

9.2 DATA PROTECTION COMPLAINTS PROCEDURE

If you are unhappy with how we have handled your personal data, you can make a data protection complaint to us by emailing office@themullanyfund.org or writing to The Mullany Fund, P.O. Box 29, Swansea, SA9 5AB. You do not need to use legal wording or refer to data protection legislation for us to treat your concern as a data protection complaint.

We will acknowledge receipt of your complaint within 30 days of receiving it. We will take appropriate steps to investigate and respond without undue delay, which may include asking you for further information, checking relevant records, speaking to staff or service providers where necessary, and considering whether any corrective action is needed. We will keep you informed about progress where the matter cannot be resolved quickly.

Once we have completed our review, we will explain the outcome of your complaint without undue delay. If you remain unhappy after we have responded, you have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection issues, at www.ico.org.uk.

Where a complaint is made on behalf of someone else, we may need to check that the person making the complaint has authority to act for them. Where a complaint is made by or on behalf of a child or young person, we will handle it in a way that takes account of their age, understanding and best interests.

9.3 YOUR DATA PROTECTION RIGHTS

You have rights in relation to your personal data. Under UK data protection law you have: the right to be informed about how your personal data is used; the right of access (to receive a copy of the personal data we hold about you); the right to rectification of inaccurate or incomplete data; the right to erasure in certain circumstances; the right to restrict processing; the right to data portability; the right to object to processing based on legitimate interests and, in every case, to object to direct marketing (which we will always honour); and the right to withdraw consent at any time where we rely on consent. Some of these rights apply only in certain circumstances, but we will respond to any request free of charge and normally within one calendar month. We do not make any decisions about you based solely on automated processing, including profiling, which have legal or similarly significant effects for you 

9.4 CHANGES TO OUR POLICY

This Privacy Notice was last updated on 25 July 2026. We may update or change this Privacy Notice from time to time, so please review it periodically. If we make a significant change to how we use your personal data, we will take reasonable steps to notify you where appropriate.