Our Privacy Notice

Who we are

Hidden Roots CIC ("we", "us") is a Community Interest Company. We are the data controller for the personal information you give us. This notice explains what we collect, why, who sees it and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

Registered Address: 11 Stafford Street, Burton-On-Trent, England, DE14 2QU. Company Number: 17169429. Data Protection Contact: Data Protection Lead, hiddenrootscic@outlook.com.

What We Collect

We only collect what we need to support you. This may include:

Name and contact details (address, email, phone)
Details of your circumstances and the support you need
Notes of conversations, advice given and actions agreed
Training, workshop and event bookings and attendance
Your contact preferences
Equality monitoring information (optional, and only with your consent)

Some of this may be "special category" data, such as information about your health. We only collect it where it is needed to support you, and we will explain why when we ask.

Why We Use Your Data

We use your data for the purposes below, and nothing else. The law requires us to state a lawful basis for each.

Providing direct support. Legitimate interests; explicit consent for any special category data.
Providing information, advice and guidance. Legitimate interests.
Enabling access to training and workshops. Legitimate interests, or contract where you book a place.
Sending information about our events. Consent.
Sending periodic service updates. Consent.
Reporting to funders and public bodies. Legitimate interests; legal obligation where a contract or law requires it.

You can withdraw consent at any time. Every email we send includes an unsubscribe link, or you can contact us directly hiddenrootscic@outlook.com.

Who We Share It With

We will never share your data with other organisations, and we will never send you marketing on behalf of other organisations. The only exceptions are:

Funders and public bodies: we report on our work to the organisations that fund us and to public bodies. Wherever possible this is anonymised or grouped so you cannot be identified. If a funder requires identifiable information, we will only share the minimum needed.
Where the law requires it: for example, to protect someone at risk of serious harm (safeguarding), or if we receive a lawful request from the police or a court.

We use trusted IT and email providers to store and send information. They act only on our instructions, cannot use your data for their own purposes and must keep it secure.

How Long We Keep It and How We Protect It

We keep your data only as long as we need it:

Support and advice records: 2 years after your last contact with us.
Training and event records: 2 years.
Mailing list details: until you unsubscribe.
Records required by funders: for the period set out in the funding agreement.

After this, records are securely deleted or destroyed. Paper records are kept locked away, digital records are password-protected, and only staff and volunteers who need access have it.

Your Rights

You have the right to:

Ask for a copy of the information we hold about you.
Ask us to correct anything that is wrong.
Ask us to delete your information.
Ask us to limit or stop using your information.
Object to how we use your information.
Withdraw your consent at any time.
Ask us to transfer your information to another organisation.

To use any of these rights, contact Data Protection Lead, hiddenrootscic@outlook.com. We will respond within one month and there is no charge.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

We review this notice regularly. Next review: October 2027.

Version 1.0 Last updated: September 2026