Privacy Notice (PIPA Statement)

Written By Emilie Faulkner-Meek

Effective date: January 1, 2025

Last updated: February 20, 2026

SkillCraft Bermuda (“SkillCraft”, “we”, “us”, “our”) is committed to respecting your privacy and protecting the personal information we use in our charitable programmes and operations.

This Privacy Notice explains how we collect, use, disclose, store, retain and protect personal information in accordance with the Bermuda Personal Information Protection Act 2016 (“PIPA”).

1. Who this notice applies to

This Privacy Notice applies to individuals whose personal information we may use, including:

  • Youth interns and other programme applicants

  • Host mentors and participating businesses

  • Donors and supporters

  • Volunteers, contractors, and staff

  • Visitors to our website and social media pages

2. What personal information we collect

Depending on your relationship with SkillCraft, we may collect and use:

A) Identity & contact information

  • Full name

  • Email address

  • Telephone number

  • Mailing address (if applicable)

B) Programme participation information (interns/mentors)

  • Application details and intake/interview responses

  • Programme participation records

  • Mentor feedback and performance-related information

  • Attendance and engagement information

C) Payment and financial information (interns)

  • Payment details required to issue intern payments (e.g., account/payment method details)

  • Limited credit card/payment information where required

D) Outcome / impact tracking

  • Work/study outcomes after the programme (e.g., education pathway, employment status, training participation)

Sensitive personal information: We do not intentionally collect sensitive personal information unless required for programme administration or legally permitted. Where we do, we take enhanced safeguards.

3. Why we use personal information (our purposes)

We use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including:

  • Administering SkillCraft programmes

  • Recruiting, selecting, and supporting interns

  • Coordinating placements with host mentors/businesses

  • Paying interns

  • Monitoring programme performance and improvement

  • Tracking programme outcomes and charitable impact over time

  • Communicating programme information and support

  • Meeting legal, regulatory, insurance, audit or governance requirements

4. Legal basis / PIPA “conditions for use”

We only use personal information where permitted under PIPA, including:

  • Consent (e.g., application forms, programme participation agreements)

  • Necessary for performance of a contract / arrangement (e.g., programme placement and payment processes)

  • Compliance with legal obligations

  • Legitimate charitable and organisational purposes, including evaluation, audit and reporting

5. How we store and protect personal information

We store most programme and operational information in Google Drive, using access controls and security safeguards.

Access restrictions

Personal information is restricted to authorised individuals only, typically:

  • Executive Director

  • Board Chair

  • A limited designated third person (where needed for programme delivery)

Safeguards we use

We use reasonable security safeguards including:

  • strong passwords and access management

  • role-based access limitation

  • minimised data access (need-to-know basis)

  • controlled sharing permissions

  • secure deletion where information is no longer required

6. Disclosure of personal information (who we share it with)

We do not sell personal information.

We may share personal information only where necessary, including:

  • with host mentors/businesses, to support placement and mentoring

  • with service providers supporting operations (e.g., cloud storage, admin tools)

  • where required by law, regulation, court order, or legitimate regulatory request

7. International transfers / cloud services

Some of our service providers (including Google) may store or process personal information outside Bermuda. Where we transfer personal information overseas, we take steps to ensure appropriate safeguards are in place consistent with PIPA expectations.

8. Data retention and destruction

We retain personal information only as long as needed for programme delivery, legal compliance, and charitable impact tracking.

A) Long-term retention (impact tracking)

We may retain the following for up to 8  years to evaluate long-term outcomes and demonstrate charitable impact:

  • names and contact information (interns and mentors)

  • work/study outcome data after programme graduation

B) 2-year retention (limited programme operations)

We aim to delete or anonymise the following after 2 years, unless needed for legal or audit reasons:

  • intake/interview data

  • detailed performance reviews and mentorship notes

  • payment information not required for longer retention

Destruction method

Where possible, destruction is completed by:

  • secure deletion from storage systems

  • deleting access links and shared folders

  • deletion of local copies (if any)

  • anonymisation where ongoing analytics are needed without identifying individuals

9. Your rights

Individuals have rights under PIPA regarding their personal information, including:

  • right to request access to their personal information

  • right to request correction of inaccurate personal information

  • right to withdraw consent (where we rely on consent), subject to legal/operational limits

Requests should be made to our Privacy Officer using the contact details below.

10. Data breach / incident response

We take data protection seriously. If we discover a suspected or confirmed loss, unauthorised access, or disclosure of personal information, SkillCraft will respond promptly.

Our breach response protocol (summary)

SkillCraft will:

  1. Contain the incident

    disable compromised accounts / revoke access

    stop unauthorised sharing

    preserve logs and evidence

  2. Assess the scope

    what data was involved (interns? payment info? impact tracking?)

    number of individuals impacted

    whether risk of harm is likely

  3. Mitigate risk
    reset credentials
    enable/enforce MFA
    conduct access review
    strengthen security controls

  4. Notify
    notify the Office of the Privacy Commissioner (“PrivCom”) without undue delay where required
    notify affected individuals where the breach is likely to adversely affect them

  5. Document
    log the incident, decisions, and remedial steps
    implement preventive improvements

11. Contact us 

Emilie Faulkner-Meek

SkillCraft Bermuda Privacy Officer
Email: info@skillcraft.bm

12. Updates to this notice

We may update this Privacy Notice from time to time. The most current version will be posted on our website and will include the effective date.2.

Emilie Faulkner-Meek