Privacy Policy

Last updated: 14th June, 2026

1. Introduction

Together For All CIC (“we”, “us”, “our”) is a Community Interest Company registered in the United Kingdom. We are committed to protecting the privacy and security of your personal information and to being transparent about how we collect and use it.

This privacy policy explains what personal data we collect when you use our website togetherforall.co.uk, take part in our programmes, contact us for support, donate, volunteer with us, or partner with us; how we use that data; and your rights under UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

If you have any questions about this notice, please contact us using the details below.

2. Who we are and how to contact us

Together For All CIC
Registered in England and Wales as a Community Interest Company.

Email: admin@togetherforall.co.uk
Phone:+44 7421 698164
Website: https://togetherforall.co.uk

We are the data controller for the personal data described in this policy, meaning we decide how and why your information is used.

If you are unhappy with how we use your data, you can contact the UK Information Commissioner’s Office (ICO) at https://ico.org.uk.

3. The personal data we collect

The type of information we collect depends on how you interact with us.

We may collect:

Identity and contact details
Names, titles, pronouns, email addresses, postal addresses, telephone numbers, and emergency contact details.
Support and service information
Information you share when you contact us for health‑related support or advice, attend workshops, participate in community sessions, or use our “Find Support” services (for example, demographic details, language needs, communication preferences, and information about your situation).
Special category (sensitive) data
Because we are a nurse‑led community organisation working on health, mental wellbeing, and sexual health, we may process limited health information and other special category data, such as:
– physical and mental health information
– sexual health information
– ethnicity and racial background
– religious or faith‑based community links where you choose to share them. We only collect this information where it is relevant, proportionate, and necessary for us to provide our services or meet our safeguarding and reporting obligations.
Engagement and participation data
Records of workshops attended, events registered for, feedback forms, referrals, case notes, and outcomes (for example, whether you accessed other services following our signposting).
Donation and fundraising information
Where relevant: donation history, Gift Aid declarations, fundraising event participation, preferences about how we contact you about fundraising.
Volunteer and partner information
Application details, CVs, references, DBS or other safeguarding checks where applicable, partner organisation contacts, partnership agreements, and correspondence.
Technical and usage data
IP addresses, browser type and version, time zone settings, device information, pages viewed, referring websites, cookie identifiers, and other data generated when you browse our website.
Marketing and communication preferences
Records of your consent (where required) and your preferences about how you want us to contact you (email, SMS, phone, post) and about which topics.

We will usually obtain data directly from you, but we may also receive information from referrers (for example, health professionals, schools, or local authorities) where you have agreed to the referral.

4. Why we process your data (purposes and lawful bases)

UK GDPR requires us to have a lawful basis whenever we process your personal data. Depending on your relationship with us and how we are using your information, we rely on one or more of the following:

Consent
For example, when you sign up to receive newsletters, agree to be contacted for evaluation, or consent to us using your story or image in our communications.
Contract
Where processing is necessary for us to deliver a service or agreement to you, such as confirming event bookings or delivering a training programme you have registered for.
Legal obligation
To comply with the law, for example in relation to safeguarding, health and safety, tax, accounting, and regulatory reporting requirements (including for Community Interest Companies).
Vital interests
In rare situations, to protect someone’s life or prevent serious harm, for example if we share information with emergency services because of immediate risk.
Public task / substantial public interest
Where appropriate and permitted by law, for example when working with public bodies or delivering services funded to improve public health outcomes.
Legitimate interests
Where our use of your data is necessary for our legitimate interests or those of a third party, and these are not overridden by your rights and interests. This may include:
– monitoring and improving our programmes
– managing our relationship with supporters and partners
– keeping our services and website secure
– limited, targeted communications about similar services or events you may be interested in.

For special category data such as health information, we rely on additional conditions under UK GDPR and the Data Protection Act 2018, including explicit consent, the provision of health or social care, safeguarding of individuals at risk, and reasons of substantial public interest (for example, equality of access and public health).

5. How we use your information

We use your personal data for the following purposes:

To provide support services
Assessing your needs, providing health and wellbeing information, signposting or referring you to appropriate services, and recording the support we provide so that we can follow up appropriately.
To deliver workshops and programmes
Managing bookings, sending event information, recording attendance, and evaluating our sessions so that we can improve what we offer.
To communicate with you
Responding to enquiries, providing updates you have requested, sending safeguarding or operational messages, and keeping records of our correspondence.
To manage volunteers, staff, and partners
Processing applications, training records, safeguarding checks where required, and managing ongoing relationships with partners, funders, and collaborators
To monitor, evaluate, and improve our services
Analysing anonymised or aggregated data to understand needs, outcomes, and effectiveness; reporting to funders, commissioners, and regulators in a way that does not identify you unless strictly necessary and lawful.
To comply with legal and regulatory obligations
Keeping financial records, Gift Aid records, safeguarding records, and responding to lawful information requests from regulators or law enforcement.
To run and protect our website
Administering the site, troubleshooting, data analysis, testing, security monitoring, and using analytics to understand how visitors use our website.
To promote our work and engage supporters
With your consent or where we rely on legitimate interests, sharing updates about our services, campaigns, and opportunities to support us, and using anonymised case studies to highlight impact.

We do not use your personal data for automated decision‑making that produces legal or similarly significant effects about you.

6. Cookies and similar technologies

Our website may use cookies and similar technologies to:

make the site work properly and keep it secure
remember your preferences
help us understand how visitors use the site so that we can improve it
support embedded content or tools (for example, forms, maps, or videos).

Where required by law, we will ask for your consent before setting non‑essential cookies (for example, analytics cookies) on your device. You can usually control cookies through your browser settings and through any cookie banner or tool we provide.

For more detail, please see our separate Cookie Policy (if available) or contact us using the details in section 2.

We treat your information as confidential and only share it where necessary, proportionate, and lawful.

We may share personal data with:

Service delivery partners
Health services (including NHS services), local authorities, schools, colleges, faith organisations, and voluntary sector partners where we work together to support you and where sharing is in line with your expectations and the law.
Professional advisers and insurers
Lawyers, auditors, accountants, and insurers, where necessary for governance, risk management, or legal claims.
Funders and commissioners
We may share aggregated and anonymised data to evidence need, outcomes, and impact. If a funder requires identifiable information, we will explain this and rely on an appropriate lawful basis, such as consent or public task, before doing so.
Service providers (processors)
Third‑party companies or individuals who provide services on our behalf, such as email platforms, IT and cloud hosting, survey and event tools, website analytics, and virtual meeting platforms. These providers must only process your data according to our instructions and must keep it secure under written contracts, as required by UK GDPR.
Regulators and law enforcement
The ICO, Companies House, HMRC, the CIC Regulator, or the police, where we are legally required to share information, for example for safeguarding, fraud prevention, or regulatory compliance.

We do not sell your personal data to anyone.

If any of our service providers or partners are located outside the UK, we will ensure that appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses, as required by UK data protection law.

8. How long we keep your data

We keep personal data only for as long as is necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements.

Retention periods may vary depending on the type of data; for example:

general enquiries: typically up to 2 years after we close the enquiry
support and case records: typically between 3 and 7 years after our last contact with you, depending on the nature of the support and any safeguarding considerations
financial and Gift Aid records: at least 6 years after the end of the financial year, as required by law
volunteer, staff, and partner records: for the duration of your role or partnership and for an appropriate period afterwards to manage any queries or legal obligations.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer be linked back to you.

You can contact us if you would like more detail about specific retention periods for particular types of information.

9. How we protect your information

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or alteration.

These measures may include:

secure systems and passwords
access controls and role‑based permissions
encryption and secure transfer of data where appropriate
staff and volunteer training on data protection and confidentiality
policies and procedures for handling data breaches and safeguarding concerns.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will assess the situation and, where required, notify you and the ICO in line with legal requirements.

10. Your data protection rights

Under UK data protection law, you have a number of rights in relation to your personal data. These include:

Right to be informed
To receive clear information about how we use your data, which is the purpose of this privacy policy.
Right of access
To ask for a copy of the personal data we hold about you (often called a Subject Access Request).
Right to rectification
To ask us to correct inaccurate or incomplete information.
Right to erasure
To ask us to delete your data where there is no good reason for us to continue using it, subject to certain legal exemptions.
Right to restrict processing
To ask us to limit how we use your data in certain circumstances.
Right to data portability
To receive the data you provided to us in a structured, commonly used, machine‑readable format and to request that we transfer it to another organisation where this is technically feasible and lawful.
Right to object
To object to our processing where we rely on legitimate interests or public task, and to object at any time to direct marketing.
Rights in relation to automated decision‑making and profiling
To not be subject to decisions based solely on automated processing that significantly affect you, and to request human review in such cases.

Some of these rights are subject to conditions and exemptions under the law. We will always explain our decision when you exercise a right.[gov]

You also have a right to make a complaint to the ICO if you are unhappy with how we handle your personal data. Before doing so, we would appreciate the chance to respond to your concerns directly

11. How to exercise your rights or make a complaint

If you would like to exercise any of your rights, ask a question about this policy, or make a complaint, please contact us using the details in section 2 and clearly describe your request.

We may need to ask for specific information to confirm your identity before we can act on your request. We aim to respond to all valid requests within one month, and we will explain if we need more time due to complexity or volume.

You can also contact the Information Commissioner’s Office at any time.

Information Commissioner’s Office
https://ico.org.uk
Telephone: 0303 123 1113 (UK)

12. Children and vulnerable adults

Our work includes supporting young people and vulnerable adults. Where we collect a child’s personal data, we will take extra care to explain what we are doing and, where required, obtain consent from a parent, guardian, or person with parental responsibility.[mhc]

We follow robust safeguarding policies and will only share information about children or vulnerable adults in line with those policies and the law, for example where we are concerned about risk of harm or abuse.

13. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our activities, services, or legal requirements. The date of the most recent version will be shown at the top of the policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.