Last updated: 5 November 2026
1. Introduction
Project SHIFA (Schooling Humanity in First Aid) CIC is committed to protecting your privacy and handling your personal information responsibly, securely and transparently.
We are a community-focused organisation dedicated to making basic life support (BLS) and first-aid education accessible to everyone. Through our free community workshops, volunteer programmes and educational partnerships, we aim to empower individuals with the knowledge and confidence to respond to emergencies.
This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, register for training, volunteer with us or otherwise engage with our activities.
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who We Are
Project SHIFA CIC is responsible for deciding how and why personal information is processed in connection with our activities, where we act as the data controller.
Organisation: Project SHIFA – Schooling Humanity In First Aid
Registered legal name: Project SHIFA CIC
Company registration number: 17480637
Registered office: Suite RA01, 195-197 Wood Street, London, E17 3NU
Website: www.projectshifa.org.uk
Email: info@projectshifa.org.uk
Instagram: @project_shifa
For questions regarding this Privacy Policy or the handling of your personal information, please contact us at info@projectshifa.org.uk.
3. Information We Collect
We only collect personal information that is reasonably necessary to deliver our activities, manage our organisation and fulfil our legal responsibilities.
Depending on how you interact with Project SHIFA, this may include:
a) Personal and contact information
- Full name
- Email address
- Telephone number
- Age or age category, where relevant
- Organisation, school, university or community affiliation
- Emergency contact details, where necessary
b) Training and event information
- Workshop registrations and attendance records
- Training preferences and booking details
- Feedback and evaluation responses
- Records of training completed or certificates issued, where applicable
- Accessibility requirements or reasonable adjustments, where voluntarily disclosed
c) Volunteer information
- Volunteer applications and contact details
- Relevant qualifications, skills and experience
- Training and attendance records
- Volunteer roles and responsibilities
- Safeguarding and background-check information, where necessary and legally permitted
d) Photographs and video recordings
We may collect photographs or videos during our workshops, community events and other activities, subject to the consent procedures described in Section 8.
e) Website and communication information
When you use our website or contact us, we may process:
- Information submitted through website forms
- Email correspondence
- IP addresses and device information
- Website usage data, where collected
- Cookies and similar technologies, where applicable
We do not intentionally collect sensitive personal information unless it is necessary for a specific, legitimate purpose.
4. How We Collect Information
We may collect personal information:
- Directly from you when you register for a workshop, complete a form, contact us or apply to volunteer.
- Through our website at www.projectshifa.org.uk.
- Through communications and administrative services provided by Google Workspace.
- Through event registration forms and feedback questionnaires.
- Through schools, mosques, universities and partner organisations where information is lawfully shared.
- Through photographs and videos taken during our activities with appropriate permission.
Where information is provided by another organisation, we will take appropriate steps to ensure that it has been shared lawfully.
5. How We Use Your Information
We use personal information for the following purposes:
Delivering first-aid education
To organise and deliver BLS workshops, manage registrations, communicate important event information and maintain appropriate attendance records.
Managing volunteers
To recruit, train, coordinate and support volunteers, allocate responsibilities and maintain appropriate records relating to qualifications and safeguarding.
Communicating with participants
To respond to enquiries, provide event confirmations, communicate schedule changes and share information directly relevant to activities in which individuals have registered.
Improving our services
To review feedback, evaluate the effectiveness of our training and improve the accessibility and quality of our educational programmes.
Promoting our mission
To share information about our activities, achievements, educational campaigns and opportunities to get involved, using identifiable photographs or other personal information only where there is an appropriate lawful basis.
Safeguarding and safety
To protect participants, volunteers and others, respond to incidents and fulfil applicable safeguarding responsibilities.
Complying with legal obligations
To maintain records and disclose information where required by applicable law.
We will not use personal information for purposes incompatible with those for which it was originally collected unless permitted by law.
6. Our Lawful Bases for Processing Information
Under the UK GDPR, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on:
Consent: Where you have freely agreed to a specific use of your information, such as the use of identifiable photographs for promotional purposes or receiving optional marketing communications.
Legitimate interests: Where processing is necessary for our legitimate organisational interests, such as coordinating community education, administering volunteer activities, improving our services and maintaining operational security, provided those interests are not overridden by your rights and freedoms.
Contract: Where processing is necessary to fulfil an agreement with you or take steps you have requested before entering into an agreement.
Legal obligation: Where processing is necessary to comply with applicable legal requirements.
Vital interests: Where processing is necessary to protect someone’s life in an emergency.
Where we rely on legitimate interests, we consider the necessity and potential impact of the processing on the individuals concerned.
Some information, including health information, religious beliefs or other special category data, receives additional legal protection. Where processing such information is necessary, we will identify an appropriate additional condition under Article 9 of the UK GDPR and any applicable requirements under the Data Protection Act 2018.
We do not assume an individual’s religious beliefs simply because they attend a workshop hosted at a mosque.
7. Children’s Privacy and Safeguarding
Project SHIFA recognises the importance of protecting children’s personal information.
Our educational activities may involve children and young people, including through family workshops, schools and community programmes.
Where we collect information relating to children, we will:
- Limit collection to information necessary for the relevant activity.
- Obtain appropriate parental or guardian involvement or permission where required.
- Respect children’s own privacy rights and their ability to make informed decisions, where appropriate.
- Apply additional safeguards to photographs, recordings and personal information.
- Restrict access to information to those who need it for legitimate purposes.
- Share information where necessary and lawful to protect a child from harm.
We will not publish identifiable photographs or videos of children without explicit, appropriate permission.
For children, this will ordinarily involve express consent from a parent or legal guardian, alongside consideration of the child’s own wishes and understanding.
Safeguarding information may need to be retained or shared where necessary to protect an individual, comply with legal obligations or support safeguarding investigations.
8. Photography, Video and Media Consent
Project SHIFA may take photographs and videos during training sessions and community events to raise awareness of first-aid education, document our activities and promote our mission.
At the beginning of each training session, participants will be asked for their consent to be photographed or recorded and for those images or recordings to be used for specified purposes.
Participants are free to decline consent, and doing so will not affect their ability to participate in our training.
Where consent is given, photographs or recordings may be used for:
- Our website
- Our official social media accounts
- Educational and awareness campaigns
- Promotional materials
- Organisational reports and presentations
We will take reasonable steps to avoid photographing or recording participants who have not consented.
Additional protections for children
We will not publish identifiable photographs or videos of children unless explicit, appropriate permission has been obtained.
Consent to photograph or record a child does not automatically constitute consent to publish that material. The intended use must be made clear when permission is requested.
Withdrawal of consent
Where we rely on consent, individuals may withdraw it at any time by contacting info@projectshifa.org.uk.
We will take reasonable steps to stop further use and remove identifiable images from materials under our control where required.
However, complete removal from materials already distributed or independently shared by third parties may not always be possible.
9. Sharing Your Information
We do not sell personal information.
We may share personal information with trusted third parties where necessary and lawful, including:
- Schools, mosques, universities and community organisations involved in delivering training.
- Authorised Project SHIFA volunteers and instructors.
- Google, where Google Workspace services are used for communications, administration and document storage.
- WordPress website hosting and service providers.
- Providers of event registration forms or secure data storage, where applicable.
- Professional advisers and relevant regulatory bodies.
- Emergency services or safeguarding authorities where necessary.
We will share only the information reasonably required for the relevant purpose.
Where third parties process information on our behalf, we will take appropriate steps to ensure that suitable data protection and confidentiality arrangements are in place.
10.Our Website, WordPress and Cookies
Our website, www.projectshifa.org.uk, is built using WordPress.
Our website and its associated services may collect certain technical information, including IP addresses, browser information, device information and website activity, where necessary for functionality, security and performance.
Our website may use cookies or similar technologies. Some cookies are strictly necessary for the website to function, while others may be used for analytics or additional features.
Where required by law, we will obtain consent before placing non-essential cookies on your device.
You can manage or disable cookies through your browser settings.
Website service information: [To be confirmed following a review of our WordPress hosting provider, installed plugins and active cookies.]
We will update this section when the relevant website services and technologies have been verified.
11.Email Communications and Google Workspace
Project SHIFA uses Google Workspace, a suite of cloud-based communication and productivity services provided by Google, to manage organisational communications, documents and administrative activities.
When you contact us or participate in our activities, we may process and store relevant personal information through Google Workspace services, including email correspondence, registration information, volunteer records and organisational documents.
We use these services to:
- Respond to enquiries and communicate with participants.
- Coordinate volunteers, instructors and community partners.
- Organise training sessions and educational activities.
- Store and manage relevant organisational records.
- Facilitate internal collaboration and administration.
Access to personal information within Google Workspace is restricted to authorised Project SHIFA personnel.
We take reasonable steps to protect information stored through these services and ensure that its processing complies with applicable UK data protection legislation.
Google may process information using infrastructure located outside the United Kingdom. Where international transfers occur, appropriate legal safeguards will be applied.
We do not use personal information collected through Google Workspace for unrelated marketing purposes without an appropriate lawful basis.
12.Email Communications and Google How We Store and Protect Your Information
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
- Password-protected accounts and appropriate authentication.
- Restricted access to sensitive information.
- Secure digital storage and communication systems.
- Confidentiality expectations for volunteers and authorised personnel.
- Regular review of information handling and retention practices.
- Appropriate procedures for responding to suspected personal data breaches.
Although we take reasonable precautions, no method of electronic storage or internet transmission can be guaranteed to be completely secure.
Where a personal data breach occurs, we will assess it and notify affected individuals or the Information Commissioner’s Office where legally required.
13.How Long We Keep Your Information
Project SHIFA retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, in accordance with applicable UK data protection legislation.
We do not apply a single fixed retention period to all personal information. Instead, retention is determined by the nature of the information, its purpose, our ongoing organisational requirements and any applicable legal or safeguarding obligations.
Our approach to retention includes:
- Training and attendance records: Retained for as long as reasonably necessary to verify training, maintain accurate organisational records and demonstrate the impact of our educational programmes.
- Volunteer records: Retained while individuals are involved with Project SHIFA and afterwards where necessary for administration, safeguarding, accountability or legal purposes.
- Photographs and videos: Retained while they remain relevant to our educational, promotional or organisational activities, subject to applicable consent requirements and data protection rights.
- Feedback and evaluation forms: Retained while necessary to evaluate and improve our services. Information may be anonymised for longer-term analysis.
- General enquiries and correspondence: Retained while necessary to manage communications, maintain relevant organisational records or address outstanding matters.
- Safeguarding and incident records: Retained in accordance with applicable legal requirements, safeguarding guidance and the circumstances of each case.
We will periodically review the personal information we hold and securely delete or anonymise information that is no longer necessary.
Anonymised statistical information, including records of the number of individuals trained and the impact of our activities, may be retained indefinitely where individuals can no longer be identified.
Individuals may request the deletion of their personal information by contacting info@projectshifa.org.uk, subject to applicable legal requirements and exceptions under data protection law.
14.Your Data Protection Rights
Under UK data protection law, you may have the following rights, depending on the circumstances:
- Right to be informed: To understand how and why your personal information is used.
- Right of access: To request a copy of personal information we hold about you.
- Right to rectification: To request correction of inaccurate or incomplete information.
- Right to erasure: To request deletion of personal information in certain circumstances.
- Right to restrict processing: To request that we limit how your information is used in certain circumstances.
- Right to data portability: To receive certain information in a portable format where the legal requirements apply.
- Right to object: To object to certain processing, including processing based on legitimate interests.
- Rights relating to automated decision-making: To receive applicable protections where decisions with legal or similarly significant effects are made solely through automated processing.
You have the right to object at any time to the use of your personal information for direct marketing.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully before consent was withdrawn.
To exercise your rights, please contact info@projectshifa.org.uk.
We will respond within the timeframes required by applicable data protection law, normally within one month, subject to any permitted extensions.
15.Marketing and Communications
We may communicate with you about training opportunities, upcoming events, volunteering and other Project SHIFA activities.
Administrative communications relating to an event or service you have requested are separate from optional marketing communications.
Where consent is required for marketing, we will obtain it before sending those communications.
You may opt out of marketing communications at any time by using an unsubscribe mechanism, where provided, or by emailing info@projectshifa.org.uk.
We will respect your communication preferences and comply with applicable electronic marketing requirements.
16.International Data Transfers
Some third-party service providers, including Google or providers supporting our WordPress website, may store or process personal information outside the United Kingdom.
Where international transfers take place, we will ensure that they comply with applicable UK data protection law.
This may involve relying on UK adequacy regulations or using approved contractual safeguards, together with any additional protections required.
You may contact us for further information about relevant international transfers and safeguards.
17.Third-Party Websites and Social Media
Our website may contain links to external websites, including social media platforms, registration services and partner organisations.
These third parties may have their own privacy policies and data handling practices.
Project SHIFA is not responsible for the privacy practices of independent third-party websites.
We encourage visitors to review the relevant privacy policies before submitting personal information to external services.
18.Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our activities, technology, legal requirements or data protection practices.
The latest version will be available on our website, with the date of the most recent update displayed at the top.
Where changes materially affect how personal information is used, we will take appropriate steps to inform affected individuals.
19.Contact Us
If you have any questions, concerns or requests relating to your personal information, please contact:
Project SHIFA CIC
Email: info@projectshifa.org.uk
Website: www.projectshifa.org.uk
Instagram: @project_shifa
We will endeavour to address privacy concerns promptly, fairly and transparently.
If you are dissatisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
You can raise a concern with the ICO without first contacting us, although we welcome the opportunity to resolve concerns directly.
⸻
Project SHIFA CIC
Schooling Humanity in First Aid