The Challenge - Cookies, Privacy and Terms

Privacy Notice

Last updated: 20/02/19

At The Challenge Network, we are committed to protecting and respecting your privacy.

This privacy notice explains the types of personal information we collect from you, why we collect it, how we will use it, who we may disclose it to and the choices available to you about that information.

We may change this policy from time to time so please check this page occasionally to ensure that you’re happy with any changes. By using our website, you’re agreeing to be bound by this privacy notice.

Who are we?

We are the Challenge Network, Mezz Floor, Elizabeth House, 39 York Road, London, SE1 7NQ, registered company in England and Wales no. 6845451.

Who controls the personal information we collect from you?

The Challenge Network holds contracts to run programmes on behalf of NCS Trust CIC and the Education and Skills Funding Authority (ESFA), as well as running our own programmes. Where The Challenge is running programmes on behalf of another organisation, those organisations remains the Data Controller for the associated personal information and the Challenge acts as a data processor.  For more information on how these arrangements affect the handling of personal data please see below.

National Citizens Service

The Data Controller for personal information processed in connection with a National Citizens Service programme is NCS Trust CIC (NCS). When you participate in an NCS programme the NCS Trust will share your information with us to facilitate or enable the delivery of those programmes. We act as their data processor and are therefore subject to the provisions made in their Privacy Notice, which can be found here.

Any personal information you provide on a young person, parental guardian or other case worker in relation to a young person’s attendance on the NCS programme will be collected and used on behalf of the NCS Trust C.I.C.


The Data Controller for personal information processed in connection with the Stepforward programme is the Education and Skills Funding Authority (ESFA). We act as their data processor and are therefore subject to the provisions made by them, which can be found in Stepforward’s own Privacy Notice, which can be found here.


HeadStart is a programme run by The Challenge Network, The Challenge is the “Data Controller” for any information processed. This means that we are responsible for deciding how we hold and use personal information about you. For more information as to how The Challenge processes information in relation to HeadStart, please see here.

When participating in any of these programmes, you will have the choice to provide us with explicit consent so that we may send you surveys and marketing materials for programmes similar to any of the programmes above.

If you take part in any of our surveys, we will use the information you provide to understand participant’s experience of the programmes we run, where we can improve that experience and how we can shape future programmes. Any data collected as part of a survey will be processed in line with the provisions contained in this privacy notice or any fair processing notice issued to you at the time of collection. In such circumstances we would be using the relevant information as an additional data controller. We may also retain information to defend ourselves against any dispute or to show compliance with legal obligations.

How will we use personal information we hold about you?

We will only use your personal information where we have a legitimate interest in doing so, where we have explicit consent or when we are meeting a contractual or legal obligation.

If you make any enquiry that includes personal information then we will use that information to answer your enquiry.

If you ask to be kept informed of how you can support us, we will use that information to contact you with details of how you can support us.

If you contact us with regards to your application to participate on a specific programme, we will use and store that data in accordance with the privacy notice set out in relation to that specific programme. These policies are linked below.

If you apply to a job advert, we will use any personal information you provide us with to assess your eligibility for the role and to comply with our legal obligations, for our Employment Privacy Notice, please see here.

We may also use any personal information we collect to investigate or address incidents claims or disputes or as otherwise allowed or required by applicable law.

Who might we share your personal information with?

Where necessary, your personal information may be shared with other organisations to enable us to respond to your query, update request or application. Where The Challenge is acting in the role of a data processor, we will share your information only with parties stipulated in the respective Data Controller’s Privacy notice.  In addition, we may have to store personal information on our IT provider systems or if you apply for a job we may have to share information with our Disclosure and Barring Service provider.

When will we delete the personal information?

Unless there is a compelling safeguarding, health and safety, dispute or other legal reason to retain information for a longer period, we will normally delete:

Type of Personal Information When It will Be Deleted
Within a general enquiry Within 3 months of completion of the general enquiry
Within a request to receive information on how you can support us 2 years and 1 day after your last confirmation that you want to continue to receive information. We will contact you ahead of this deadline to remind you to re-subscribe if interested.
Within an unsuccessful job application Within 6 months from confirmation that you were unsuccessful
Within a successful job application Within the period of time set out in whatever employment contract or subsequent privacy statement you receive
Within a request regarding an individual’s participation on one of our programmes Within the timelines set out in our the privacy notice for that programme which is linked above.
Any other information that would be necessary to record or defend any incident or dispute or show compliance with legal obligations. Up to twenty years after receipt of the information


Where The Challenge is acting in the capacity as a data processor, we will retain information according to the retention schedules stipulated in the respective Data Controller’s Privacy Notice.

Will the personal information ever be stored or transferred outside the EEA?

We may from time to time need to use the services of an IT provider that stores or accesses your personal information outside the European Economic Area (EEA). However, we will only do so if there are appropriate safeguards to protect the information. For example, we will put in place European Commission model contractual clauses, ensure the supplier has binding corporate rules in place regarding data security and/or ensure the relevant country is recognised as having adequate data security by the European Commision. For details of such safeguards please email.

What rights might you have in relation to your personal information?

You are entitled to:

  • request copies of personal information that we hold about you;
  • require inaccurate personal information to be corrected if it is inaccurate or incomplete; and
  • in some circumstances:
    • request that your personal information is erased, for example, if it’s no longer necessary for the purpose we hold it for;
    • request that the use of your personal information is restricted, for example, where you have raised concerns as to the accuracy of the information;
    • object to our use of their personal information, for example, if the information being used for one of our legitimate interests like a collection for evidence, research, statistics;
    • withdraw consent to our use of your personal information going forward, for example, where you have requested support information but have changed your mind; and
    • have the personal information provided to us be transferred to another organisation.

If you wish to exercise any of these rights please email.

Use of “Cookies”

Like many websites, we use “cookies”. “Cookies” are small pieces of information sent to and stored on your computer, phone or tablet to allow the website to recognise you when you visit. They collect statistical data about your browsing actions and patterns to improve the website but do not identify you as an individual. It is possible to switch off cookies by setting your browser preferences. For more information, please visit our cookies policy on this website. Turning cookies off may result in loss of certain functions on this website.

Changes to this privacy notice

We reserve the right to change our privacy notice without prior notice however we will endeavour to update this page as regularly as feasibly possible. We, therefore, urge you to review this statement from time to time to ensure you are up-to-date with how we are using and protecting your information.

How to contact us

If you have a query or concern about this privacy notice or our use of personal information or want to exercise any of the above rights regarding your personal information please contact:

Ngozi Onodugo

If you are not happy with our observance of data protection legislation, you have the right to lodge a complaint with the Information Commissioner’s Office by visiting here.