Last updated: 4th November 2024

Security of your data is our first priority and this page outlines some of our operating procedures and security practices.

Definitions

We, our, us - Online Youth Manager Ltd - registered office 12 West Links Tollgate, Chandler's Ford, England, SO53 3TG.

You, your, user - a person logging on via the Login page.

Member - a person that has been added to the system (typically a member of your organisation).

Section - the entity that is registered with the system that members belong to (e.g. a Scout section, Guide unit, Boys' Brigade section, club, unit, etc).

Support team - our employees or contractors who have access to provide support to you.

Confidentiality

We place strict access controls over your data and are committed to ensuring that nobody has access to your data that shouldn't.

If you contact our support team, you will grant them temporary access to your section(s) so that they can provide support to you. Members of our support team are vetted and have strict rules and controls about what they can do with their access, and their usage is monitored. They cannot access your section(s) unless you contact support.

The operation of our systems requires that some of our employees and contractors have access to the systems that store and process your data. Our employees and contractors are prohibited from using this access to view your data unless absolutely required.

Our employees undergo periodic data, security and privacy training, and they are bound by Non Disclosure Agreements.

Security Features

Logging

Usage of our system by users, the support team, employees and contractors is logged. We track every login, including the time, device details, IP address and a fingerprint of the device. This data is automatically purged after a period of time.

Access

We have a password policy requiring passwords to be at least 12 characters with three different types of characters, and that the password is not in the top 10,000 commonly used passwords. Passwords are stored using a non-reversible method.

We have a compulsory secondary layer of authentication that requires all users to enter certain characters from an answer to a security question when they logon on a new device (if they aren't using Two Factor Authentication). The available security questions are obscure and are unlikely to be known by others (e.g. "Mother's maiden name" is not an option).

If users forget their credentials, they can only reset their password after receiving an email with a time-restricted link. If they have forgotten their security answer, they can only reset their password after a text message/phone-call with a verification code.

Users can opt to use Two Factor Authentication that provides them with a code that expires in 60 seconds.

Users are automatically logged out of the system after a period of inactivity.

Users who attempt to login with invalid credentials too many times will be temporarily blocked from the system.

Users are encouraged to periodically review their access control lists to ensure fellow users have the right access.

External Audits

We contract respected security firms to perform 'penetration testing' (sometimes known as 'ethical hacking') to ensure that data can only be seen be the right people.

Infrastructure

Physical Locations

Our data is replicated in two separate data-centres in London to ensure that we can provide business continuity.

Data

We do not share personal data to third-parties without your explicit consent, with the exception of the third party processors outlined below who process data according to our contracts with them.

We are not responsible for the data that users add within the system, including its accuracy. This includes, but is not limited to, contents of external links, activities, emails, downloads and attachments.

Mobile System

Our mobile system stores data for offline use by users - sensitive personal data is encrypted on their device.

The system automatically removes data held on the device when the user no longer has access to the section. In the event of a device being lost, users can contact our support team to tell the device to remove its data when it is next used online.

Encryption

Our data is encrypted in transit between our servers and your browser, and our database is encrypted at rest.

Our employees' computers have full-disk encryption (although your data is not stored on employees' devices).

Intrusion Detection Systems

We have systems that monitor the usage and automatically block users who appear to be malicious.

Firewalls and Software Patching

Firewalls are configured according to industry best practices and all unnecessary ports are blocked.

We perform automated network vulnerability scanning and software patching.

Backups

Database backups are taken daily, and are stored for a week.

Weekly database backups stored for six months.

Backups and files are stored in multiple geographical locations.

Data Retention and Processing Duration

We do not automatically delete personal data and will continue processing data until it is deleted. Users can delete data from their sections according to their access rights. This schedules the deletion of data after 30 days (to allow for restoring of accidentally deleted data).

Legal Jurisdiction

We operate under the laws of England and Wales.

Third Party Processors

Braintree Payments and Stripe

Users may pay for services using a credit or debit card. Braintree Payments is used for cards added before 2021, and Stripe is used for cards since 2021. We do not store any cardholder data.

GoCardless

Parents are able to make payments to their sections. Payments can be handled by GoCardless, who are regulated by the Financial Conduct Authority. We do not receive bank details.

Stripe

Parents are able to make payments to their sections. Payments can be handled by Stripe, who are regulated by the Financial Conduct Authority. We do not receive card details.

Stripe is also used by our Expense Card system.

Amazon

Amazon is our hosting provider. It hosts our website, database, files, and it sends emails.

SendGrid

SendGrid is used as a backup email provider.

TextAnywhere

TextAnywhere provides our SMS services.

Twilio

Twilio provides our telephony services.

Cloudflare

Cloudflare provides our Content Delivery Network which is used to host member/user profile pictures.

~{prelogin.cmp}

Cookie Script

Cookie Script is a Google certified Consent Management Platform used to gain consent for optional cookies.

~{/prelogin.cookieyes}

Data Types

We are the data controller of your user account details, which includes your name, email address and phone number. We also store information about your browser and how you use the system. We will send you transactional emails (e.g. receipts), and if you have opted-in to marketing emails, you may receive occasional marketing emails.

We are the data processor for all information added by users about members. This is likely to include the following types of data:

• Name
• Date of birth
• Contact details
• Gender
• Medical requirements
• Achievements, attendance, payments, etc

We process data under the contractual lawful basis, with a contract between us and the Section. The Section will be collecting data about its members using its own lawful processing basis.

Data Subject Rights

Breach Notification

We will notify our users of any breach of data via email within 72hrs of identifying the breach.

Right to Access

Users are able to download information about members if required, and the support team can provide assistance if the downloads are not sufficient.

Right for Erasure

Users are able to delete all personal data, including from the audit trail.

Data Portability

Users can download personal information in a spreadsheet format. It should be noted that this requirement is only applicable if you use 'consent' for your lawful processing mechanism. 'Legitimate interests' is likely to be more appropriate and therefore consent is not required, as the data provided by parents is expected to be stored and processed for the purposes of running a Group/Unit and its associated events.

Privacy by Design

Our system is always designed with privacy as our top priority. Features are tested manually by our expert development teams, automatically as part of the development & deploy process, and through external security audits.

Data Protection Officer

Evalian Limited act as our Data Protection Officer. They can be contacted via the Contact Us pages.