Privacy Policy

HRE4U CIC (“we”, “us”, “our”) is a Community Interest Company based in the UK. We are committed to keeping your information safe, private, and handled with honesty. This policy explains what data we collect through our website and, where relevant, during in person support, how we use it, and the choices you have.

Who We Are

HRE4U CIC
Company No. 16856183
ICO Registration Number: ZC047426

Registered Address:
Level One, Basecamp Liverpool,
49 Jamaica Street,
Liverpool,
England,
L1 0AH

HRE4U CIC is the data controller for the personal information collected through this website and our in person services.

Information We Collect

We only collect the minimum information needed to run our website and support our services, both online and, where relevant, in person. This includes:

• Account Information: If you create an account, we store your email, a securely hashed password, saved tools, and any mood tracker entries you choose to record. These entries are private to you and are not analysed, scored, or used for profiling.
• Newsletter Sign-Ups: If you subscribe, we store your email so we can send updates. You can unsubscribe at any time, and we never sell or share your address.
• Contact Messages: Messages sent through our contact page are sent to our email inbox using our web server. They are not stored in a database and are deleted when no longer needed.
• Local Device Storage: Some tools, such as safety plans, may save data on your device using your browser’s localStorage. This never leaves your device unless you choose to save it to your account.
• Essential Cookies: Our site uses essential cookies required for login, site functionality, and to help prevent repeated submissions of surveys from the same device. These cookies do not identify you and are not linked to your responses. We do not currently use analytics or tracking cookies.
• Server Logs: Our hosting provider may automatically collect basic technical logs such as IP addresses, browser type, timestamps, and pages visited. These logs are short-lived and used only for security, performance monitoring, and anonymous impact reporting.
• In Person Minimal Records: If you visit one of our physical spaces, we may record minimal information when needed for safety or safeguarding, such as the date of a concern and any action taken. We do not record detailed conversations or personal histories.

Future Analytics (For CIC Impact Reporting)

As part of our responsibilities as a Community Interest Company, we may introduce anonymous analytics in the future to understand how the site is used. These would:

• not collect personal information
• not identify you
• only help us understand traffic patterns
• be added to this policy before being switched on

Café Check-Ins (Future Feature)

When the HRE4U Café opens, visitors may choose to log in while on site. This helps us understand how the space is being used and supports safety.

The café system will only record:

• a time and date of visit
• an anonymised user ID (hashed)

No identifying information, mental health notes, or personal messages are recorded.

In Person Support and Minimal Records

When visiting our café or pop up spaces, we do not record detailed personal stories, mental health notes, or private conversations.

If a safety concern arises, we may make a minimal safeguarding note. This would only include:

• the date of the concern
• a brief description of the risk
• any action taken (for example, calling emergency services)

These records are stored securely and only accessed by the safeguarding lead.

How We Use Your Information

We use your information only for:

• managing your account and saved resources
• sending newsletters (if you opt in)
• responding to your messages
• improving our website and tools
• basic anonymous impact reporting using server log information
• preparing anonymised CIC reports

We do not use your data for advertising or profiling.

Legal Basis for Processing

• Consent: newsletters, optional features, and non essential cookies.
• Legitimate Interest: running our services safely and understanding how they are used.

Data Retention

We keep your data only for as long as needed.

• Newsletter emails are retained while you are subscribed.
• Contact emails are usually deleted within 12 months.
• Account data remains until you delete your account.
• Safeguarding notes are retained only as long as legally and practically required.

Data Security

We take your privacy seriously. Measures include:

• secure server storage
• hashed passwords
• encrypted data in transit (HTTPS)
• limited access to data on a need-only basis

Safeguarding records, if made, are managed by the appointed Safeguarding Lead (John Boyham) and only accessed on a need-to-know basis.

Sharing and Disclosure

We do not sell your data and we do not share it for advertising or marketing purposes.

We may share limited information with trusted third parties only when necessary to run our services safely, or where we are legally required to do so.

There are rare situations where we may need to share limited information in order to protect safety. This may include situations where:

• someone is at immediate risk of serious harm or death
• there is a serious safeguarding concern
• a vulnerable person is unable to keep themselves safe
• we are legally required to do so

In these cases, we may contact emergency services, local safeguarding teams, or other appropriate authorities.

We will only ever share the minimum amount of information necessary, and where possible, we will be open and honest with you about what we are doing and why.

For full details of how we handle safeguarding concerns and safety decisions, please see our Safeguarding Policy.

Shop Purchases (Shopify)

Our shop is hosted externally by Shopify. If you make a purchase, Shopify processes your order information. We do not store or have access to your full payment details.

Donations and Payments

If you donate to HRE4U CIC, payments are processed through PayPal, Stripe, or GoFundMe. We do not store your card details.

Children’s Privacy

The website is designed for users aged 16 and over.

Our in person spaces focus on adult support. Anyone under 18 may attend only with a parent or guardian and does not receive direct emotional support.

We do not knowingly collect personal data from children.

Your Rights

• access the personal data we hold
• correct inaccurate information
• request deletion of your data
• withdraw consent
• export your data

Complaints

If you are unhappy with how your information has been handled, you have the right to complain to the Information Commissioner’s Office (ICO).

You can find more information at www.ico.org.uk.

Questions?

If you have questions, contact us via the contact page or email.