LEGAL
Privacy policy
Last updated: 1 June 2026
1. Who we are
Trailstones ("Trailstones", "we", "us", "our") operates the Trailstones platform, which connects young people (aged 16–21) with local businesses and charities through structured, real-world project work.
We are responsible for personal data processed through this website and platform. If you have any questions about how we use your data, contact us at privacy@trailstones.co.uk.
2. What data we collect
We collect different personal data depending on how you use the platform.
Young people
Name, email address, age range, school or college, project submissions, portfolio content, and references received. We do not collect sensitive personal data unless you voluntarily include it in submissions.
Charity partners
Organisation name, contact name, email address, project briefs posted, and feedback provided on completed work.
Schools and colleges
Institution name, careers lead contact details, and aggregated student progress data for Gatsby Benchmark reporting.
3. How we use your data
- To create and manage your account and match you with suitable projects.
- To facilitate project work between young people and charity partners.
- To generate verified portfolio entries and written references.
- To produce cohort progress reports for partnered schools and colleges.
- To improve the platform, diagnose technical issues, and ensure security.
- To send service-related communications (account updates, project status). We will only send marketing communications with your explicit consent.
4. Legal basis for processing
We process personal data under the following UK GDPR bases:
| Processing activity | Legal basis |
|---|---|
| Account creation and management | Contract (Article 6(1)(b)) |
| Project matching and facilitation | Contract (Article 6(1)(b)) |
| References and portfolio entries | Legitimate interests (Article 6(1)(f)) |
| School progress reporting | Legitimate interests (Article 6(1)(f)) |
| Marketing emails | Consent (Article 6(1)(a)) |
| Platform security and analytics | Legitimate interests (Article 6(1)(f)) |
5. Who we share your data with
We do not sell your personal data. We share data only as necessary to operate the platform:
- Charity partners receive submitted project work and your first name when you apply to a brief.
- Partnered schools and colleges receive aggregated and, where agreed, individual progress summaries.
- Hosting and infrastructure providers (processors) who operate under strict data processing agreements.
- We may disclose data if required by law or to protect the safety of our users.
6. How long we keep your data
Account data is retained for as long as your account is active. If you close your account, we will delete personal data within 90 days. Portfolio entries and references are retained for 3 years after account closure unless you request earlier deletion — these are core outputs of the service and may be referenced by charities or employers.
Anonymised, aggregated data (e.g. total projects completed per school) may be retained indefinitely as it cannot be used to identify you.
7. Your rights
Under UK GDPR you have the following rights:
Access
Request a copy of the personal data we hold about you.
Rectification
Ask us to correct inaccurate or incomplete data.
Erasure
Request deletion of your personal data in certain circumstances.
Portability
Receive your data in a structured, machine-readable format.
Restriction
Ask us to limit processing in certain circumstances.
Object
Object to processing based on legitimate interests or for direct marketing.
To exercise any of these rights, email privacy@trailstones.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8. Cookies and tracking
We use only essential cookies required to operate the platform (session management and CSRF protection). We do not use advertising trackers, third-party analytics that process personal data, or any form of cross-site tracking. If this changes, we will update this policy and seek consent where required.
9. Young people and children
Trailstones is designed for users aged 16 and over. Users aged 16 and 17 can register and consent to our terms directly under UK GDPR. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has registered, please contact us at privacy@trailstones.co.uk and we will delete the account promptly.
We take particular care with data about young people and apply appropriate safeguards including limiting visibility of profile information to matched charity partners only.
10. Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes by email and update the "Last updated" date at the top of this page. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.
Questions or concerns?
Contact our data team at privacy@trailstones.co.uk. We aim to respond to all privacy enquiries within 5 working days.