This is a draft for review, not legal advice. It replaces the Enzuzo-generated policy currently published, which has an empty “Personal Data We Collect” section and claims compliance with around 25 data protection regimes that do not apply to a Leeds-based CIC. Someone with data protection expertise should check it before it goes live.
The open questions in the final section need answering first — several affect what the policy can honestly say.
HelloHopeUK CIC (“we”, “us”, “our”) delivers mental health first aid and suicide prevention training across the UK. We are the data controller for the personal data described in this policy.
Registered address: Ground Floor, Radley House, Grangefield Industrial Estate, Pudsey, West Yorkshire, LS28 6LE
Email: info@hellohope.uk
Company number: 15657647 (incorporated 18 April 2024, a community interest company limited by guarantee)
This policy covers hellohope.uk and the personal data we collect through it. It does not cover separate sites we link to, including hopemap.uk, awards.hellohope.uk, leedswellbeingweek.uk, or our Ticket Tailor event pages — those have their own privacy terms.
We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our use of cookies is governed by the Privacy and Electronic Communications Regulations (PECR).
What we collect depends on how you use the site. We do not collect more than we need, and we never ask for health information through this website.
How you interact with us | What we collect |
|---|---|
Browsing the site | IP address, browser type and version, device type, pages visited, time of visit, referring site |
Contacting us through a form | Name, email address, and whatever you choose to write in your message |
Subscribing to our newsletter | First name, last name, email address |
Requesting a quote or booking a course | Name, email address, organisation, and the details you give about your training needs |
Buying from our shop | Name, billing and delivery address, email address, phone number if given, order contents and history |
Making a donation | We do not receive your card details. PayPal tells us the donation amount and the name and email on the PayPal account |
Emailing us directly | Your email address and the content of your message |
A note on sensitive information. None of our forms ask for health data, and we would rather you did not include it. If you write something about your own mental health in a message to us, we will treat it with care and will not use it for any purpose beyond responding to you.
If you are in crisis, this website is not a crisis service and we cannot respond quickly. Please contact Samaritans on 116 123, free, 24 hours a day.
Under UK GDPR we must have a lawful basis for everything we do with your data. Ours are set out below.
What we do | Why | Lawful basis |
|---|---|---|
Reply to your enquiry | So we can answer your question | Legitimate interests — responding to people who contact us |
Arrange and deliver training | To provide the course you asked for | Contract |
Process shop orders | To take payment, dispatch goods and handle returns | Contract |
Keep records of orders and donations | To meet accounting and tax obligations | Legal obligation |
Send our newsletter | To share news and updates | Consent — you can withdraw it at any time |
Protect our forms from spam | To keep the site usable | Legitimate interests — site security |
Understand how the site is used | To improve it | Consent, through the cookie banner |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we think it is not. You can object to this processing — see section 10.
We do not sell your personal data. We do not use it for automated decision-making or profiling.
We share data only with the organisations that help us run the site and our services. Each processes data on our instructions, under a contract.
Who | What they do | What they receive |
|---|---|---|
IONOS | Hosts the website | Everything stored on the site, including form submissions and orders |
PayPal | Processes donations and shop payments | Payment details, which go directly to PayPal and not to us |
FluentCRM | Runs our newsletter | Name and email address of subscribers |
Mailchimp | Sends marketing email | Name and email address of subscribers |
Cloudflare | Spam protection on our forms (Turnstile) | IP address and browser information |
Website analytics and performance measurement | Browsing data, where you have consented | |
Google Fonts | Supplies the typefaces the site uses | IP address, when a page loads |
Microsoft | Our email service | The content of emails you send us |
Ticket Tailor | Event ticketing | Booking details you give them directly |
We may also disclose personal data where the law requires it, or to establish or defend legal claims.
If HelloHopeUK CIC is ever merged, acquired or dissolved, personal data may transfer to the successor organisation. We would tell you before that happened.
Cookies are small files stored on your device. Some are needed for the site to work; others are not, and under PECR we must ask your permission before setting those.
Type | What it does | Consent needed |
|---|---|---|
Strictly necessary | Keeps your shopping basket, remembers you are logged in, protects forms from spam | No |
Analytics | Tells us which pages are visited and how people move through the site | Yes |
Marketing | Measures advertising and campaign performance | Yes |
You can change or withdraw your cookie preferences at any time using the link in the footer. You can also block or delete cookies in your browser settings, though some parts of the site may stop working properly if you block the strictly necessary ones.
Fuller detail about each cookie, including how long it lasts, is in our Cookie Policy.
This section cannot be published as written until the cookie banner is in place. See the open questions at the end.
Some of the organisations listed in section 4 are based outside the UK, mainly in the United States. That means your personal data may be transferred and stored there.
Where data leaves the UK, we rely on the UK’s adequacy regulations or on International Data Transfer Agreements, which require the recipient to protect your data to UK standards.
If you would like more detail about the safeguards for a particular transfer, email info@hellohope.uk.
We keep personal data only as long as we need it.
Data | How long we keep it |
|---|---|
Enquiry and contact form messages | 2 years from your last contact with us |
Newsletter subscriptions | Until you unsubscribe, then we remove your details within 30 days |
Course booking records | 6 years, to meet accounting requirements |
Shop orders and donation records | 6 years, to meet accounting and tax requirements |
Website analytics | 14 months |
Spam-blocked form submissions | 30 days, then deleted |
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
The site runs over an encrypted HTTPS connection, so anything you send through a form travels securely.
Access to the website’s administration area is limited to the people who need it, and we review that access periodically. We keep the site, its plugins and its theme up to date, and we take regular backups.
We require the organisations listed in section 4 to have their own security measures in place and to handle your data only as we instruct.
No system is completely secure. If a breach happens that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner’s Office within 72 hours, as the law requires.
This website is aimed at adults. We do not knowingly collect personal data from children under 13 through it.
In the UK, 13 is the age at which a child can consent to their data being processed by an online service. If you are under 13, please ask a parent or guardian before sending us any information.
We deliver youth mental health training, and some of that work involves young people. Where it does, data is collected through the organisation booking the training — a school, college or employer — under a separate agreement, not through this website.
If you believe we hold data about a child that we should not, email info@hellohope.uk and we will delete it.
Under UK GDPR you have the following rights over your personal data.
To exercise any of these, email info@hellohope.uk or write to us at the address in section 1. We will respond within one month. We may ask you to confirm your identity first, to make sure we do not disclose your data to someone else.
To unsubscribe from our newsletter, use the unsubscribe link in any email we send. You do not need to contact us.
If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
We may update this policy from time to time. The current version is always on this page, and the date at the top shows when it last changed. If we make a significant change, we will say so on the site.
Contact us about your data:
Email: info@hellohope.uk
Post: HelloHopeUK CIC, Ground Floor, Radley House, Grangefield Industrial Estate, Pudsey, West Yorkshire, LS28 6LE
We aim to respond within five working days, and within one month for formal requests about your rights.
