Who We Are

"We", "us", and "our" mean HRE4U CIC and, where the context requires, people authorised to act on its behalf.

HRE4U CIC

Company Number: 16856183

ICO Registration Number: ZC047426

HRE4U CIC is the data controller for the personal information collected through this website and our in-person services.

Information We Collect

We aim to collect only the personal information that is relevant and reasonably necessary to operate our website, provide our services, keep people safe, and meet our legal and organisational responsibilities.

Depending on how you interact with HRE4U, this may include:

• Account information: If you create an account, We may store your email address, securely hashed password, account settings, saved tools, and information you choose to save within your account. Information such as mood-tracker entries is not used for advertising or automated profiling.
• Newsletter information: If you subscribe to our newsletter, We store your email address and information about your subscription so We can send updates and manage unsubscribe requests.
• Messages and enquiries: If you contact Us through our website, email, telephone, WhatsApp, social media, or another communication channel, We may receive your name, contact details, message, and any other information you choose to provide.
• Bookings and attendance: If you book or attend a café, event, workshop, appointment, or activity, We may collect information such as your name, contact details, postcode, booking information, attendance status, accessibility requirements, deposit or payment status, and any information needed to manage the booking safely and fairly.
• Support, referral, and service information: If you ask for practical support, signposting, a referral, a foodbank voucher, employment support, legal support, or help from another provider, We may collect the information needed to understand your request, check eligibility, obtain consent, make the referral, and record the outcome.
• Safeguarding and safety information: Where a safeguarding or serious safety concern arises, We may record relevant information about what was observed, disclosed, or reported, the people involved, decisions made, and action taken. This may include sensitive or special-category personal information where it is necessary to protect someone from harm.
• Volunteer and provider information: If you apply to volunteer, work with Us, or provide a service through HRE4U, We may collect contact details, role information, availability, training records, references, DBS-related information where applicable, attendance, access permissions, insurance details, and other information needed to manage the relationship safely and appropriately.
• Payments, donations, raffles, and fundraising: If you make a payment, donation, purchase a lottery ticket, enter a fundraising activity, pay an attendance deposit, place an auction bid, or receive a prize, We may collect your name, contact details, transaction status, amount, ticket or entry information, delivery details, and records needed for administration, accounting, fraud prevention, and legal reporting. We do not store your full card number or security code.
• Information stored on your device: Some tools may store information locally on your device using browser storage. This information normally remains on your device unless you choose to submit it, share it, or save it to your HRE4U account.
• Cookies and session information: We use cookies and similar technologies for website sessions, login, security, cookie preferences, and other functions described in our Cookie Policy.
• Website statistics: Our first-party website statistics may record the page visited, date and time, referrer, a temporary random session identifier, and a hashed version of the visitor's IP address. These records are not used for advertising, automated profiling, or cross-site tracking and are retained for up to 12 months.
• Server and security logs: Our hosting provider and website systems may automatically record technical information such as IP address, browser or device information, timestamps, requested pages, errors, and security events. This information is used to operate, protect, diagnose, and maintain the website.

We do not ask people to provide more personal information than is reasonably needed for the relevant service. However, information you choose to share during a conversation or request may sometimes include sensitive details about health, wellbeing, disability, family circumstances, finances, housing, abuse, or other personal matters.

Attendance, Events and Service Records

We collect limited information to understand how our cafés, events, and support services are being used, manage bookings fairly, prevent duplicate referrals, and support our Community Interest Company reporting.

• Café and session attendance: We record anonymous attendance numbers for our sessions. These records do not include names or other direct identifiers.
• Event bookings: For events, We may retain the attendee's name, the first part of their postcode, booking details, and whether they attended, cancelled, or did not attend. These records are normally retained for up to 12 months.
• Referrals, emails, and foodbank vouchers: Where We send a referral, service email, or foodbank voucher, our internal systems may record the person's first name, a hashed version of their surname, and their email address. The hashed surname is used to help prevent duplicate referrals or vouchers and is not used for tracking or profiling.

These records are used for service administration, safety, eligibility and duplicate checks, attendance monitoring, service improvement, and anonymised impact reporting. They are not used for advertising or automated profiling.

In Person Support and Safeguarding Records

During our cafés, events, and other in-person services, We do not routinely record detailed personal stories, counselling notes, or transcripts of conversations.

Where a safeguarding concern, welfare concern, or other significant incident arises, We may create a safeguarding record. Depending on the circumstances, this may include:

• the date and time of the concern or incident
• the people involved
• relevant information that was observed, disclosed, or reported
• decisions made and the reasons for those decisions
• any action taken, including referrals or contact with emergency services or other organisations where appropriate
• any follow-up action considered necessary

Safeguarding records are stored securely and are only accessible to authorised members of the HRE4U team on a strict need-to-know basis.

How We Use Your Information

We only use personal information where it is relevant, necessary, and lawful to do so. Depending on the service you use, your information may be used to:

• create and manage your account and any information you choose to save
• provide our website, tools, cafés, events, workshops, and other services
• respond to enquiries, requests for support, and referrals
• administer bookings, attendance, deposits, fundraising activities, raffles, auctions, and donations
• manage volunteers, providers, and partnerships
• protect people through safeguarding, welfare, and safety procedures where appropriate
• improve our website, services, and resources using first-party website statistics and anonymised reporting
• meet our legal, regulatory, financial, and governance responsibilities as a Community Interest Company
• send newsletters and service updates where you have asked to receive them or where we are otherwise permitted to do so
• prevent fraud, misuse, duplicate referrals, duplicate foodbank vouchers, and other abuse of our services

We do not sell personal information or use it for advertising, automated decision-making, or profiling.

Legal Basis for Processing

We only process personal information where there is a lawful basis for doing so. The basis relied upon will depend on the information involved and why it is being used.

• Consent: where you have given clear permission, such as when subscribing to our newsletter or agreeing to optional cookies or features.
• Contract: where processing is necessary to provide something you have requested, such as managing an account, booking, payment, lottery entry, auction, or other service.
• Legal obligation: where We must use or retain information to meet legal, regulatory, financial, safeguarding, or accounting responsibilities.
• Legitimate interests: where processing is reasonably necessary to operate, protect, administer, and improve HRE4U CIC and its services, provided those interests are not overridden by your rights and freedoms.
• Vital interests: where processing is necessary to protect someone's life or prevent serious harm.

Where We process special-category information, such as information about health, disability, racial or ethnic origin, religion, sexual orientation, or similar sensitive matters, We will also identify an additional condition permitted by data protection law.

Special-Category and Criminal-Offence Information

Some support, safeguarding, accessibility, volunteer, or referral records may contain special-category personal information or information relating to alleged or proven criminal offences.

We only process this type of information where it is necessary, proportionate, and permitted by law. Depending on the circumstances, this may be based on explicit consent, vital interests, safeguarding, preventing or detecting unlawful acts, protecting people from harm, establishing or defending legal claims, or another condition provided by law.

Access to this information is restricted to authorised people who need it for the relevant purpose.

Data Retention

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

• Website accounts and saved information: normally retained until you delete your account or ask Us to remove it.
• Newsletter subscriptions: retained while you remain subscribed or until you unsubscribe.
• Contact messages: normally retained for up to 12 months.
• Event bookings and attendance records: normally retained for up to 12 months.
• Website statistics: detailed first-party page-view records are retained for up to 12 months before being securely deleted.
• Volunteer and provider records: retained while the relationship continues and for a reasonable period afterwards where necessary for administration, safeguarding, insurance, or legal purposes.
• Financial records: retained for the period required by applicable accounting and tax legislation.
• Safeguarding records: retained only for as long as is reasonably necessary to protect people, meet safeguarding responsibilities, comply with legal obligations, or establish, exercise, or defend legal claims.

If you ask Us to delete your personal information, We will normally do so unless We are required or permitted by law to retain some or all of it.

Data Security

We take appropriate technical and organisational measures to help protect the personal information We hold.

• encrypted connections using HTTPS
• securely hashed passwords
• role-based access controls so information is only available to authorised team members where needed
• a secure hosting environment managed through cPanel and its associated security features
• access to sensitive information on a strict need-to-know basis

Although We work hard to protect personal information, no website or electronic storage system can ever be guaranteed to be completely secure. We continually review our systems and procedures as HRE4U develops.

To help protect personal information, HRE4U volunteers and team members use authorised HRE4U devices, or other devices approved by HRE4U for official use, when collecting information, managing bookings, recording referrals, logging attendance, taking event photographs, or communicating with people on behalf of HRE4U.

Volunteers and team members must not use their personal email addresses, personal telephone numbers, or personal messaging accounts to communicate with people using HRE4U services. Where possible, communication will come from an official @hre4u.co.uk email address or an authorised HRE4U telephone number.

If you are ever unsure whether a communication is genuinely from HRE4U, please stop the conversation and contact Us before sharing any personal information.

Official HRE4U emails will come from an @hre4u.co.uk email address. You can verify any communication through one of our official contact channels on our Contact Us page.

Occasionally, an external provider such as a solicitor, employment adviser, or another referral partner may contact you directly using their own official email address or telephone number. Where this is expected, We will explain this to you when making the referral so you know who will be contacting you.

In very rare circumstances, an event provider may also contact attendees directly about an event. Where possible, We will let you know in advance if this is likely to happen.

Where Information Comes From

Most personal information We use is provided directly by you.

In some circumstances, We may also receive relevant information from another person or organisation, such as a family member, representative, referral partner, external provider, emergency service, local authority, or safeguarding organisation. Where appropriate, We will explain that information has been received and how it will be used.

International Data Transfers

Some third-party services used by HRE4U, including communication, payment, hosting, social-media, or embedded-content providers, may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, We will take reasonable steps to ensure that the transfer is covered by UK adequacy regulations, appropriate contractual or organisational safeguards, or another lawful transfer mechanism.

Sharing and Disclosure

We do not sell personal information or share it for advertising, marketing, or profiling purposes.

We will only share personal information where it is reasonably necessary to provide our services, where you have asked Us to do so, where you have given your consent, or where We are required or permitted to do so by law.

Depending on the circumstances, this may include sharing information with trusted organisations or professionals involved in delivering services or support, such as referral partners, external service providers, payment providers, email providers, our website hosting provider, emergency services, safeguarding agencies, local authorities, or other organisations where appropriate.

We may also share information where it is necessary to:

• protect someone from serious harm or immediate danger
• respond to a safeguarding concern
• complete a referral or provide a service you have requested
• comply with a legal obligation, court order, or lawful request from a public authority
• prevent, detect, or investigate suspected fraud or criminal activity

Whenever We share personal information, We aim to share only the minimum amount reasonably necessary for the purpose concerned. Where it is appropriate and safe to do so, We will also explain what information is being shared and why.

Further information about how We manage safeguarding concerns can be found in our Safeguarding Policy.

Donations and Payments

If you make a donation, purchase lottery tickets, pay an attendance deposit, make a fundraising payment, or complete another payment through HRE4U, the payment will normally be processed by the third-party payment provider identified at the time of payment.

Payment providers may collect information such as your name, email address, billing details, payment method, transaction amount, and payment status in accordance with their own privacy policies.

Card details are entered directly into the payment provider's secure systems. HRE4U CIC does not store or have access to your full card number or card security code.

We may retain limited transaction information, such as your name, contact details, amount paid, payment status, transaction reference, and the purpose of the payment, where needed for administration, accounting, refunds, fraud prevention, and legal reporting.

Children's Privacy

HRE4U is primarily an adult-focused service, and our website, online tools, cafés, events, and support services are generally intended for people aged 18 and over.

We do not knowingly provide emotional or crisis support to children or deliberately collect personal information from anyone under 18 through our adult services.

In exceptional circumstances, a child or young person may be present at one of our spaces with the prior agreement of the Safeguarding Lead and while accompanied by a parent, guardian, or other responsible adult. The responsible adult remains responsible for them at all times.

If We become aware that personal information relating to a child has been collected inappropriately, We will take reasonable steps to review, restrict, or delete it unless it must be retained for safeguarding or legal reasons.

Your Data Protection Rights

Depending on the circumstances and the lawful basis being relied upon, you may have the right to:

• ask for access to the personal information We hold about you
• ask Us to correct inaccurate or incomplete information
• ask Us to delete personal information where there is no lawful reason for it to be retained
• ask Us to restrict how your information is used in certain circumstances
• object to certain processing carried out on the basis of legitimate interests
• withdraw consent at any time where processing is based on consent
• ask for certain information you provided to be supplied in a portable format where the right to data portability applies
• raise a concern or make a complaint about how your information has been handled

Some rights are not absolute and may not apply in every situation. For example, We may need to retain information to meet safeguarding, legal, financial, regulatory, or insurance responsibilities.

To exercise a data protection right, please contact Us through our Contact Us page or email hello@hre4u.co.uk. We may need to confirm your identity before responding.

Data Protection Complaints

If you believe We have not handled your personal information properly, you can make a data protection complaint through our Contact Us page or by emailing hello@hre4u.co.uk.

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate, and explain the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK's independent data protection regulator. Further information is available from the Information Commissioner's Office.

Policy Review

We review this Privacy Policy at least once every 12 months and may update it sooner where our services, systems, legal responsibilities, or use of personal information changes.

Questions or Contact

If you have any questions about this Privacy Policy, how We use personal information, or your data protection rights, please contact Us through our Contact Us page or email hello@hre4u.co.uk.