Privacy Policy | Breakout 2026

INTRODUCTION

The Breakout Youth Mental Health Summit ("Breakout", "the Summit", "we", "our", or "us") is a youth-focused event providing education, discussion, workshops, and resources relating to mental health, wellbeing, healthy relationships, personal development, online safety, and other issues affecting young people in Bermuda.

We take the privacy, dignity, safety, and confidentiality of young people seriously.

This Privacy Policy explains how personal information is collected, used, protected, disclosed, retained, and deleted when students, parents, guardians, presenters, or other participants interact with the Breakout Youth Mental Health Summit or www.breakout.community.

This Privacy Policy has been prepared in accordance with Bermuda's Personal Information Protection Act 2016 ("PIPA"), including applicable amendments.

Particular attention is given to:

Section 5, Responsibility and Compliance
Section 6, Conditions for Using Personal Information
Section 7, Sensitive Personal Information
Section 8, Fairness
Section 9, Privacy Notices
Section 10, Purpose Limitation
Section 11, Proportionality
Section 12, Integrity and Retention
Section 13, Security Safeguards
Section 14, Security Breaches
Section 15, Overseas Transfers
Section 16, Personal Information About Children
Sections 17 to 20, Individual Rights and Requests

OUR PRIVACY PRINCIPLES

Breakout follows these principles when handling personal information:

We collect only information reasonably required to operate the Summit.
We give additional protection to information concerning young people.
We require parental or guardian consent for student registration.
We restrict access to registration information.
We do not sell student information.
We do not use student information for behavioural advertising.
We do not create commercial profiles of students.
We do not require students to disclose mental health diagnoses to participate.
We apply additional safeguards where sensitive personal information is provided.
We delete or anonymise information when no longer reasonably required.

RESPONSIBILITY UNDER PIPA

Breakout is responsible for personal information within its custody or control.

Section 5 of PIPA requires organisations to adopt appropriate measures and policies to give effect to their obligations under the Act and protect the rights of individuals.

Where third-party service providers are used to process personal information on behalf of Breakout, appropriate privacy and security requirements will apply.

A designated Privacy Officer or responsible representative will oversee privacy compliance and requests relating to personal information in accordance with section 5 of PIPA.

WHO THIS POLICY APPLIES TO

This Privacy Policy applies to personal information concerning:

Students.
Parents and guardians.
Summit participants.
Presenters and facilitators.
Volunteers.
School representatives.
Workshop leaders.
Website users.
Individuals submitting information through www.breakout.community.

INFORMATION WE COLLECT DURING REGISTRATION

Breakout collects limited personal information needed to register students and safely administer the Summit.

STUDENT INFORMATION

We collect:

Student full name.
Student email address.
Grade level.
Selected Summit sessions or workshops.
Student name included within the waiver and consent process.

The registration form identifies student grade level as:

Middle School.
Senior School.

We use this information to register the student, organise appropriate sessions, manage attendance, communicate relevant Summit information, and support the safe operation of the event.

PARENT AND GUARDIAN INFORMATION

Parental or guardian consent is required for all student registrations.

We collect:

Parent or guardian full name.
Parent or guardian email address.
Parent or guardian telephone number.
Consent information.
Information associated with the Summit waiver.

Parent and guardian information is used to:

Verify consent.
Communicate important Summit information.
Contact a responsible adult where necessary.
Respond to an emergency.
Administer the student's participation.
Maintain appropriate consent records.

SESSION SELECTION INFORMATION

Students might select preferred Summit sessions as part of registration.

Session selections are used for:

Workshop allocation.
Capacity planning.
Scheduling.
Attendance management.
Event administration.

A student's selection of a workshop relating to mental health, bullying, family relationships, stress, anxiety, social media, identity, or another topic must not automatically be treated as evidence that the student has experienced the issue personally.

Breakout will not create psychological profiles or draw conclusions about a student's mental health based solely upon workshop selections.

MENTAL HEALTH AND SENSITIVE PERSONAL INFORMATION

Because Breakout is a mental health summit, students might voluntarily disclose information relating to:

Mental health.
Emotional wellbeing.
Disability.
Medical conditions.
Family circumstances.
Bullying.
Abuse.
Relationships.
Personal experiences.
Other sensitive matters.

Section 7 of PIPA provides additional requirements concerning sensitive personal information.

Breakout does not require students to disclose a mental health diagnosis as a condition of registration or participation unless specific information is reasonably necessary to provide appropriate support or protect the student.

Where sensitive personal information is provided, access will be limited to individuals who reasonably require the information for the relevant purpose.

CONDITIONS FOR USING PERSONAL INFORMATION

Section 6 of PIPA establishes the conditions under which an organisation is permitted to use personal information.

Depending upon the circumstances, Breakout might use personal information based upon:

PARENT OR GUARDIAN CONSENT

Parental or guardian consent is required for student registration.

Consent will be requested in a clear manner as part of the registration and waiver process.

ADMINISTRATION OF REGISTRATION

Information submitted during registration is used to administer the student's participation and provide the requested Summit services.

LEGAL REQUIREMENTS

Personal information might be used or disclosed where authorised or required by Bermuda law.

EMERGENCIES

Section 6 of PIPA provides for the use of personal information in circumstances involving an emergency threatening the life, health, or security of an individual or the public.

This might apply where information must be provided to emergency services or another appropriate authority to protect a student.

PURPOSE LIMITATION

Section 10 of PIPA establishes the principle of purpose limitation.

Information collected through Breakout registration will primarily be used for:

Student registration.
Parental consent.
Workshop allocation.
Event administration.
Attendance management.
Student communications.
Parent or guardian communications.
Emergency contact.
Safety and safeguarding.
Evaluation of overall Summit participation.

Personal information will not be used for a materially unrelated purpose unless permitted under PIPA.

PROPORTIONALITY

Section 11 of PIPA requires personal information to be adequate, relevant, and not excessive for the purpose for which it is used.

Breakout therefore seeks to collect the minimum information reasonably necessary to operate the Summit.

The registration form does not require students to provide:

Mental health diagnoses.
Medical histories.
Medication lists.
Detailed counselling information.
Personal therapy records.
Unnecessary family information.
Unnecessary sensitive personal information.

CHILDREN AND YOUNG PEOPLE

Breakout is specifically designed for young people.

We therefore apply enhanced privacy protections to student information regardless of whether every participant falls within PIPA's specific statutory definition of a child for a particular provision.

Section 16 of PIPA establishes specific requirements where an organisation provides an information society service targeted at children or has actual knowledge that personal information about children is being used.

Where section 16 applies and consent is relied upon, verifiable consent from a parent or guardian will be obtained before collecting or otherwise using the child's personal information.

Breakout goes further operationally by requiring parental or guardian consent for all student participants, including Middle School and Senior School students.

PARENTAL CONSENT

A student registration is not considered complete until the required parent or guardian consent process has been completed.

The consent process should identify:

The student.
The parent or guardian.
The nature of the Summit.
The information being collected.
The purposes for which information will be used.
Relevant participation conditions.
Any separate media consent, where applicable.

Consent for Summit participation does not automatically constitute consent for unrelated uses of a student's personal information.

STUDENT EMAIL ADDRESSES

Student email addresses are collected for Summit-related communications.

Student email addresses will not be:

Sold.
Published.
Added to unrelated commercial marketing databases.
Shared with presenters for independent marketing.
Provided to sponsors for advertising.
Used to build advertising profiles.

Where practical, important communications involving younger participants should also involve the parent, guardian, school, or responsible adult.

EMERGENCY CONTACT INFORMATION

Parent and guardian contact information is collected partly to support student safety.

Emergency contact information might be used where:

A student becomes ill.
A student is injured.
A student experiences significant distress.
A safeguarding concern arises.
A student needs to leave the event.
Event staff need to contact the responsible adult.

Emergency contact information will not be used for unrelated commercial purposes.

SAFEGUARDING DISCLOSURES

A student might disclose information during a workshop, discussion, activity, or conversation that raises a safeguarding concern.

Examples include disclosures involving:

Abuse.
Neglect.
Exploitation.
Bullying.
Sexual abuse.
Online exploitation.
Threats of violence.
Immediate danger.
Serious risk of harm.

Breakout will not promise absolute confidentiality where a disclosure indicates that a young person or another person might be at risk.

Information will be shared only with persons or authorities who reasonably need the information to protect the student or meet applicable legal and safeguarding responsibilities.

Breakout's Child Protection and Safeguarding procedures apply to such situations.

PHOTOGRAPHS AND VIDEO

Photography or video might take place during the Summit.

Registration for the Summit does not automatically constitute unrestricted consent for a student's identifiable image to be used for promotional purposes.

Where identifiable photographs or video of students will be used for publicity, marketing, social media, future Summit promotion, or similar purposes, appropriate consent should be obtained.

Where practical, media consent should be separate from mandatory consent required for participation.

A student should not be excluded from the educational programme solely because a parent or guardian declines optional promotional photography consent.

INFORMATION WE DO NOT SELL

Breakout does not sell personal information.

Student information will not be sold or provided to:

Advertisers.
Data brokers.
Marketing databases.
Sponsors for independent marketing.
Commercial profiling companies.

INFORMATION SHARING

Personal information might be shared with authorised persons where reasonably necessary for the operation or safety of the Summit.

Recipients might include:

Authorised Summit staff.
Registration administrators.
Safeguarding personnel.
School representatives where appropriate.
Emergency services.
Appropriate Government authorities.
Technology providers processing information on behalf of Breakout.
Other parties where disclosure is authorised or required by law.

Presenters and workshop facilitators will not automatically receive student registration records.

Access should be limited to information reasonably necessary for their role.

THIRD-PARTY REGISTRATION AND TECHNOLOGY SERVICES

Breakout might use third-party technology to provide:

Registration forms.
Email communications.
Website hosting.
Cloud storage.
Event administration.
Website security.

Where a third party processes personal information on behalf of Breakout, appropriate privacy and security measures will be required.

Section 5 of PIPA places responsibility on an organisation for personal information under its custody or control, including where third parties are engaged in connection with its use.

OVERSEAS TRANSFERS

Some website, registration, email, hosting, or cloud service providers might process information outside Bermuda.

Section 15 of PIPA governs transfers of personal information to overseas third parties.

Where personal information is transferred outside Bermuda, Breakout will take appropriate steps to assess the protection provided and apply safeguards required under PIPA.

WEBSITE INFORMATION

When you visit www.breakout.community, limited technical information might be generated through normal website operations.

This might include:

IP address.
Browser type.
Device type.
Operating system.
Date and time of access.
Pages viewed.
Referring website.
Security logs.

Such information will be used where reasonably necessary for:

Website operation.
Cybersecurity.
Troubleshooting.
Performance.
Aggregated website statistics.

COOKIES

The Breakout website might use cookies or similar technologies for:

Essential website functionality.
Security.
Registration forms.
User preferences.
Website performance.
Aggregated analytics.

We do not intend to use the website to create advertising profiles of student visitors.

Where non-essential tracking technologies are introduced, appropriate privacy information and controls will be provided where required.

ACCURACY

Section 12 of PIPA requires personal information to be accurate and kept up to date to the extent necessary for its intended use.

Parents, guardians, students, and participating organisations should inform Breakout where important registration information changes.

This is particularly important for:

Parent or guardian contact information.
Student contact information.
Emergency contact information.
Participation status.

RETENTION

Section 12 of PIPA requires organisations not to retain personal information longer than necessary for its use.

Breakout will therefore review personal information after the Summit.

Student registration records will be retained only for as long as reasonably required for:

Summit administration.
Attendance records.
Safeguarding.
Incident management.
Consent records.
Legal requirements.
Insurance requirements.
Dispute resolution.

Information no longer required will be securely deleted, destroyed, or anonymised.

Sensitive information arising from a safeguarding matter might be subject to a different retention period where required to protect a child, document an incident, meet legal obligations, or support an investigation.

SECURITY SAFEGUARDS

Section 13 of PIPA requires organisations to protect personal information using safeguards appropriate to the sensitivity of the information and the risk of harm.

Breakout will use reasonable administrative, technical, and physical safeguards.

Measures might include:

Restricted access to registration records.
Password-protected systems.
Multi-factor authentication where available.
Secure website connections.
Controlled access to registration platforms.
Limited access to sensitive disclosures.
Staff confidentiality requirements.
Secure storage.
Appropriate deletion procedures.
Security updates.

Student information should only be accessible to individuals who require access for an authorised Summit purpose.

SECURITY BREACHES

Section 14 of PIPA establishes requirements concerning breaches involving personal information.

Where a security breach is likely to adversely affect an individual, Breakout will follow applicable PIPA requirements concerning investigation, mitigation, documentation, and notification.

Where required, the Privacy Commissioner and affected individuals will be notified without undue delay.

ACCESS TO PERSONAL INFORMATION

Section 17 of PIPA provides rights concerning access to personal information, subject to applicable limitations and exceptions.

An individual might request:

Access to personal information held about them.
Information about the purposes for which their information has been used.
Information concerning persons or types of persons to whom information has been disclosed.

Requests involving a student will be handled with appropriate regard for the student's age, circumstances, applicable rights, parental responsibility, safeguarding considerations, and PIPA.

CORRECTION OF INFORMATION

Section 19 of PIPA provides rights to request correction of errors or omissions in personal information.

Parents, guardians, or eligible individuals who believe registration information is inaccurate should contact Breakout.

Where an error or omission is established, the information will be corrected as soon as reasonably practicable.

ERASURE OR DESTRUCTION

Section 19 of PIPA provides rights concerning erasure or destruction of personal information where the information is no longer relevant for the purposes of its use.

A request for deletion will be considered in accordance with PIPA.

Some information might need to be retained for:

Safeguarding.
Legal obligations.
Incident management.
Insurance.
Establishing or responding to legal claims.
Other lawful purposes.

MARKETING

Registration information will not automatically be used to enrol students or parents in unrelated commercial marketing.

Section 19 of PIPA provides rights concerning requests to cease or not begin certain uses for advertising, marketing, or public relations.

Where Breakout wishes to send optional promotional communications concerning future events, an appropriate consent or other condition permitted under PIPA will be used.

PRIVACY REQUESTS

Requests concerning personal information should be submitted in writing.

A request should provide enough information for Breakout to identify the person and locate the relevant records.

Requests might include:

Access requests.
Correction requests.
Erasure requests.
Requests concerning certain uses.
Privacy complaints.

Contact:

Privacy Officer
Breakout Youth Mental Health Summit
Bermuda

Website: www.breakout.community

Email: [Insert Privacy Contact Email]

Subject: Breakout Privacy Request

Requests will be processed according to the procedures and applicable timeframes established under PIPA.

COMPLAINTS

If you believe your personal information or a student's personal information has been handled improperly, please contact the Breakout Privacy Officer.

Individuals also have rights to raise privacy matters with the Office of the Privacy Commissioner for Bermuda in accordance with PIPA.

PRIVACY NOTICE

Section 9 of PIPA requires organisations to provide a clear and easily accessible privacy notice explaining their personal information practices.

This Privacy Policy serves as Breakout's general privacy notice.

Short-form privacy information should also be displayed at the point where student registration information is collected.

The registration form should provide a clear link to this Privacy Policy before the parent or guardian provides consent.

CHANGES TO THIS POLICY

Breakout will review this Privacy Policy periodically.

Updates might be required because of:

Changes to Summit registration.
Changes to workshops.
New website functionality.
New service providers.
Changes in Bermuda law.
Updated guidance from the Privacy Commissioner.
Changes to safeguarding procedures.

The latest version will be published at www.breakout.community.

GOVERNING LAW

This Privacy Policy and the handling of personal information by the Breakout Youth Mental Health Summit are governed by the laws of Bermuda, including the Personal Information Protection Act 2016.

Nothing in this Privacy Policy limits any right or protection available under PIPA.

CONTACT

For privacy questions or requests concerning personal information:

Privacy Officer
Breakout Youth Mental Health Summit
Bermuda

Website: www.breakout.community

Subject: Breakout Privacy Request

Effective Date: September 28, 2026

Last Updated: September 28, 2026

Version 1.0