As a Christian non-profit seeking to provide the utmost care and respect for young people and parents/carers we work with, eXp cares about your privacy. This policy seeks to inform you about who we are, what information is, what information we collect, and your rights regarding this data, in line with the General Data Protection Regulation.

Who are we?

eXp – Experiencing Faith in Cowal, Scottish Charity Number SC046355, is a Christian non-profit Youth Work organisation operating on behalf of the Church of Scotland, working with Churches across Cowal. It seeks the advancement of education through engaging with and working alongside schools in Cowal, offering both formal and informal educational programmes and activities so that young people are better equipped to make good choices, the organisation of recreational activities with the object of improving the conditions of life for the children and young people of Cowal, thereby assisting the development of their physical, mental, emotional and spiritual wellbeing, and the advancement of religion by fulfilling the above purposes at all times within a framework of Christian faith and values, working in active engagement with the Church of Scotland congregations in Cowal and with other Cowal churches and other agencies. Leading the team is Mrs Susan Whyte. Our registered address is:

Minahey Cottage
PA21 2AD

Our Office is located at:

eXp Youth Work
130b John St
PA23 7BN

What is personal data?

Personal data is any data about, or that identifies you, the individual. Personal data can vary in its nature and consists of:

  • Contact data, e.g., name, contact details (email address, phone number, address, etc.)
  • Personal data, e.g., date of birth, gender, ethnicity, etc.
  • Financial, e.g., account details, credit/debit card details, and financial transactions.
  • Social, e.g., criminal, professional status (job title, salary, etc.), social networking, relationships, and communications.

How do we collect information?

We collect data for everyone taking part in eXp activities.  This is updated as and when required and on an annual basis.  Data is normally collected by the completion of paper forms which is then entered onto an electronic storage system after which the forms are shredded.

Any financial transactions made, either for services/activities or by donation will be recorded for audit purposes.  No banking details are retained.

If you input your information in a contact form on our website, we will collect this information for contacting you, and will contact you only if you wish to be contacted.

What type of information is collected?

When you engage with us, we may collect information about you. This may include interactions you have had with us and other information relating to you personally which you may choose to provide to us.

Data protection law recognises that certain types of personal information are more sensitive. This is known as “sensitive” or “special category” personal information and covers information revealing racial or ethnic origin, religious or philosophical beliefs and political opinions, trade union membership, genetic or biometric data, information concerning health or data concerning a person’s sexual orientation.

Sensitive information will only be collected where necessary, for example, we may need to collect health information from you when you register for an event, take part in a project, or attend a training session. We may need to understand more about your background to support the monitoring of the effectiveness of our projects. Clear notices will be provided at the time we collect this information, stating what information is needed, and why and which parts are optional.

With your explicit consent, we may also collect sensitive personal information if you choose to tell us about your experiences for use in research or a case study.

eXp will capture which may include (but will not be exclusive to):

  • Contact data, e.g., name, contact details (email, phone, address, etc.)
  • Personal data, e.g., date of birth, gender, location, and any special health issues, etc.
  • Financial data, e.g., account details, financial transactions, and payments received. Bank account details may be on our system if a refund payment has been made. These can be deleted upon request made to
  • Social data, e.g., criminal status, professional status (job title, salary, etc.), social networking, and communications.

You will be made aware of any data eXp will be collecting, with a clear statement as to why and what it will be used for.

Why do we collect information?

We collect data to administer, deliver and monitor our services and support to young people, youth practitioners and parents, respond to enquiries and requests, and meet our legal obligations.


To help promote the value of our work, eXp takes a range of photos, video, and audio content. Photos, videos, and audio content may be used by eXp, or by our event partner(s) (including funders) on websites, social media, promotional materials, publications, press releases, or other illustrations of our work.

We will ask for consent from individuals that will be used in photos where they may be identifiable. Where the individual is under the age of 18 or a vulnerable adult, we will seek the consent of the parent/guardian. Consent can be withdrawn at any time and will be notified on all paperwork. If consent is withdrawn, we will stop using the photos/videos/audio content for future purposes but may not be able to retract publications already in the public domain.

How can you withdraw your consent?

eXp captures consent for several of its activities which are identified above in “What type of information is collected?”.

Consent can be withdrawn at any point by contacting us via

Young people and members participating in a programme can withdraw their consent at any point by contacting us.

How do we store and secure data?

The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR). Data will be stored electronically and will be password protected and any hard copies will be stored in a locked filing cabinet for security purposes.

In line with data protection principles, eXp will ensure information kept is:

  • Used fairly, lawfully, and transparently.
  • Used for specified, explicit purposes.
  • Used in a way that is adequate, relevant, and limited to only what is necessary.
  • Accurate and, where necessary, kept up to date.
  • Kept for no longer than is necessary.
  • Handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, and destruction or damage.

Who has access to your information?

eXp does not sell any personal data that we hold. Data is secure within eXp.  This data will only be shared with eXp staff, volunteers, and third parties if and when necessary.

Third-Party Service Providers working on our behalf

We may pass your information to our third-party service providers, agents, subcontractors, and other associated organisations to complete tasks and provide services to you on our behalf. However, when we use third-party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure.

We will not contact you for marketing purposes by email, phone, or text message unless you have given your prior consent. You can change your marketing preferences at any time by contacting us by email at

Contact forms

Any information you enter in one of our contact forms is automatically processed and sent to the required email addresses you wish to contact. Your contact details will be treated with confidentiality within eXp unless you wish otherwise.

Embedded content from other websites

Articles on this site may include embedded content (e.g., videos, images, articles, etc.). Embedded content from other websites behaves in the same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Analytics Software

We use cookies from third-party partners such as Google and Facebook for understanding our audience. These cookies allow us to understand who we are working with based on their age, gender, and location, alongside other platform-specific data. We currently use Google Analytics for tracking our website engagement, YouTube Studio for tracking our YouTube engagement, and Facebook Business Suite for tracking our Facebook and Instagram engagement. As part of Google’s agreement, they will show you ads on websites you visit after visiting our website.

Facebook and Instagram Insights

We use Facebook and Instagram Insights to understand our audience better. These functions are offered by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA and Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. These services collect information such as your age, gender, and location, and track how you engage with Facebook and Instagram pages.

YouTube Studio

We use YouTube Studio analytics information to better understand how you engage with our YouTube channel. This collects information such as your age, gender, and location. For more information, see YouTube’s Terms of Use at

Google Analytics

This website uses Google Analytics, a web analytics service. It is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called “cookies”. These are text files that are stored on your computer and that allow an analysis of the use of the website by you. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

Google Analytics cookies are stored based on Art. 6 (1) (f) DSGVO. The website operator has a legitimate interest in analysing user behaviour to optimize both its website and its advertising.

IP anonymization

We have activated the IP anonymization feature on this website. Your IP address will be shortened by Google within the European Union or other parties to the Agreement on the European Economic Area before transmission to the United States. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there. Google will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activity, and to provide other services regarding website activity and Internet usage for the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data held by Google.

Browser plugin

You can prevent these cookies from being stored by selecting the appropriate settings in your browser. However, we wish to point out that doing so may mean you will not be able to enjoy the full functionality of this website. You can also prevent the data generated by cookies about your use of the website (incl. your IP address) from being passed to Google, and the processing of these data by Google, by downloading and installing the browser plugin available at the following link:

Objecting to the collection of data

You can prevent the collection of your data by Google Analytics by clicking on the following link. An opt-out cookie will be set to prevent your data from being collected on future visits to this site: Disable Google Analytics.

For more information about how Google Analytics handles user data, see Google’s privacy policy:


We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. This service is provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”).

reCAPTCHA is used to check whether the data entered on our website (such as on a contact form) has been entered by a human or by an automated program. To do this, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics. This analysis starts automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g., IP address, how long the visitor has been on the website, or mouse movements made by the user). The data collected during the analysis will be forwarded to Google.

The reCAPTCHA analyses take place completely in the background. Website visitors are not advised that such an analysis is taking place.

Data processing is based on Art. 6 (1) (f) DSGVO. The website operator has a legitimate interest in protecting its site from abusive automated crawling and spam.

For more information about Google reCAPTCHA and Google’s privacy policy, please visit the following links: and

Data Retention

Personal data stored by eXp is only kept for as long as necessary and is deleted when an individual is no longer involved with eXp activities. This is reviewed on an annual basis.

Managing your information

The accuracy of your information is important to us. If you wish to request to access what information we possess about you or wish to make any amendments to this information, please contact us by email at

Furthermore, if you no longer wish eXp to store and process your data, you have the right to request that it be deleted by contacting us at

Under GDPR, eXp must respond to a request to have your data erased, however, there are circumstances where we will be unable to erase data due to other obligations. For example:

  • Where there are financial transactions on your record (where part of the data must be kept for a set period). In this instance, we will keep the data that must be held for financial and audit purposes and will erase all data not required for this purpose.
  • Where there has been a disciplinary/safeguarding issue, etc.

In these cases, full details and an explanation of our decision will be communicated to you.

Your rights

Individuals about whom we collect, process, and store personal data have legal rights under GDPR (General Data Protection Regulations) which include:

  • Be informed about how your data is being used.
  • Access personal data.
  • Have incorrect data updated.
  • Have data erased.
  • Stop or restrict the processing of your data.
  • Data portability (allowing you to get and reuse your data for different services).
  • Object to how your data is processed in certain circumstances.