top of page
The-EmpowHER-Project-logo

Privacy Policy

1. Who we are

​

The EmpowHER Project CIC is a community interest company providing trauma-informed, neurodiversity-aware support, courses, activities and community opportunities for women.

Our company details are:

Organisation: The EmpowHER Project CIC
Company number: 16355474
Registered in: England and Wales
Email: info@empowhercic.org
Website: www.empowhercic.org
Address: 8 Cathedral Road, Cardiff, CF11 9LJ

For data-protection purposes, The EmpowHER Project CIC is the data controller. This means we are responsible for deciding how and why personal information is collected, used and protected.

​

2. About this Privacy Policy

​

This Privacy Policy explains how we collect, use, store and protect personal information when you:

  • visit our website;

  • contact us through our website, email or social-media pages;

  • complete an enquiry, registration, contact or referral form;

  • sign up to receive news or updates;

  • register an interest in a course, activity or event;

  • work with us as a professional, partner, funder or supporter; or

  • apply for employment, volunteering or other opportunities.

Women participating in our services may also receive a separate Participant Privacy Notice containing more detailed information about how we manage participant, referral and support records.

​

3. The information we may collect

​

The personal information we collect will depend on how you interact with us.

It may include:

  • your name;

  • email address;

  • telephone number;

  • postal address;

  • preferred method of contact;

  • organisation, job title or professional role;

  • information included in an enquiry or message;

  • course, event or activity interests;

  • referral information;

  • emergency-contact details, where necessary;

  • accessibility, communication or support requirements;

  • employment or volunteering information;

  • photographs, videos or testimonials where permission has been given;

  • information about how you use our website;

  • your IP address, browser type, device information and cookie preferences; and

  • records of consent and communication preferences.

We will only ask for information that is relevant and necessary for the reason you are contacting us.

​

4. Special category information

​

In some circumstances, particularly when someone is asking for support or being referred to our services, we may receive information concerning:

  • physical or mental health;

  • disability or neurodivergence;

  • racial or ethnic origin;

  • religious or philosophical beliefs;

  • sexual orientation;

  • experiences of trauma, domestic abuse or addiction; or

  • other sensitive personal circumstances.

This is known as special category data under data-protection law and requires additional protection.

Where we process special category information, we will identify both an appropriate lawful basis under UK data-protection law and an additional condition for processing special category data.

Depending on the circumstances, this may include:

  • explicit consent;

  • protecting someone’s vital interests;

  • safeguarding individuals at risk;

  • providing confidential support; or

  • another substantial-public-interest condition recognised by law.

We will only rely on these conditions where they genuinely apply and where appropriate safeguards are in place.

Please avoid including detailed medical, trauma or safeguarding information in a general website contact form unless the form specifically asks for it.

Special category data requires an ordinary lawful basis as well as a separate condition under Article 9 of the UK GDPR.

Last updated: 29 July 2026

5. Criminal offence information

​

In some circumstances, referral or support information may include details relating to:

  • criminal convictions;

  • alleged offences;

  • investigations or court proceedings;

  • probation or licence arrangements;

  • prison history; or

  • other involvement with the criminal justice system.

Criminal offence information is subject to additional legal protection and is not treated in exactly the same way as special category data.

We will only collect and use criminal offence information where it is necessary, lawful and appropriately protected.

Where required, we will identify an appropriate lawful basis and a relevant condition under the Data Protection Act 2018. We will maintain appropriate internal documentation regarding our use of this information.

UK data-protection law provides additional protection for information relating to criminal convictions, offences, allegations, investigations and proceedings.

​

6. How we collect your information

​

We may collect information:

  • directly from you when you complete a form, email us, telephone us or send us a message;

  • from a professional or organisation referring you, where there is a lawful basis to do so;

  • when you register for one of our courses, events or activities;

  • when you interact with our social-media pages;

  • automatically through cookies and similar website technologies;

  • from organisations with which we work in partnership; or

  • from publicly available professional sources, where appropriate.

When another person or organisation provides information about you, we will take reasonable steps to ensure you are aware of how your information is being used, unless an applicable legal exception applies.

​

7. Why we use your information

​

We may use personal information to:

  • respond to enquiries;

  • process expressions of interest and referrals;

  • assess whether a course, activity or service is suitable;

  • communicate with participants, professionals and partners;

  • organise and deliver courses, events and activities;

  • provide appropriate accessibility or communication support;

  • manage safeguarding concerns;

  • maintain accurate organisational records;

  • manage complaints, concerns and feedback;

  • recruit employees, contractors or volunteers;

  • communicate with funders, commissioners and partners;

  • monitor and improve our website and services;

  • measure attendance, outcomes and organisational impact;

  • send newsletters or updates where you have requested them;

  • comply with legal, regulatory, insurance or funding requirements; and

  • protect the rights, safety and wellbeing of participants, employees, volunteers and others.

Where possible, information used for monitoring, evaluation, funding reports or publicity will be anonymised or presented in a way that does not identify individuals.

​

8. Our lawful bases

​

Under UK data-protection law, we must have a lawful basis for using personal information. Depending on the circumstances, we may rely on the following bases.

Consent

We may rely on your consent when you:

  • sign up for marketing emails or newsletters;

  • agree to the use of non-essential cookies;

  • give permission for identifiable photographs, videos, stories or testimonials; or

  • choose to provide certain optional information.

You may withdraw your consent at any time by contacting us.

Withdrawing consent will not affect any lawful processing that took place before your consent was withdrawn.

Contract

We may use information when it is necessary to provide a service, course, activity or arrangement that you have requested, or to take steps before entering into an agreement.

 

Legal obligation

We may use or retain information when required to comply with the law, including obligations concerning:

  • safeguarding;

  • employment;

  • finance and taxation;

  • insurance;

  • health and safety; or

  • regulatory reporting.

 

Legitimate interests

We may use information where it is necessary for the legitimate operation and development of The EmpowHER Project CIC, provided those interests are not overridden by your rights and freedoms.

These interests may include:

  • responding to professional and partnership enquiries;

  • managing our organisation and services;

  • maintaining appropriate records;

  • improving our website and activities;

  • protecting our systems and preventing misuse; and

  • communicating with existing professional contacts about relevant organisational matters.

 

Vital interests

In an emergency, we may use or share information where it is necessary to protect someone’s life or physical safety.

9. Safeguarding and confidentiality

​

We treat information shared with us respectfully and confidentially. However, confidentiality is not absolute.

We may need to share information without consent where we reasonably believe:

  • a child or adult is at risk of abuse, neglect or serious harm;

  • someone’s life or immediate safety is at risk;

  • a serious crime has been or may be committed;

  • disclosure is required by law or a court order; or

  • another lawful safeguarding obligation applies.

Where it is safe and appropriate, we will explain the situation before sharing information.

We will only share information that is relevant and necessary.

Our website and general email inbox are not emergency services and should not be used to report an immediate emergency.

​

10. Who we may share information with

​

Where necessary and lawful, we may share relevant information with:

  • employees, directors, facilitators, volunteers or contractors who need it to perform their role;

  • organisations working with us to deliver a course, activity or service;

  • referring professionals or organisations;

  • safeguarding authorities or emergency services;

  • health, social-care, housing, criminal-justice or support services, where appropriate and lawful;

  • funders, commissioners, evaluators or research partners, normally using anonymised or aggregated information;

  • professional advisers, insurers, accountants or auditors;

  • website, email, database, booking, cloud-storage or IT service providers;

  • payment-processing providers, where payments are made;

  • government, regulatory or law-enforcement bodies where legally required; or

  • another organisation where you have asked us to make a referral or introduction.

We do not sell or rent personal information.

We require organisations processing information on our behalf to protect it and use it only for the agreed purpose.

​

11. Website and service providers

​

Our website is hosted and supported using Wix.

Information submitted through the website may therefore be processed through Wix’s website, form, hosting, security, analytics or communication systems.

We may also use trusted third-party systems to manage:

  • referrals;

  • registrations and attendance;

  • emails and newsletters;

  • cloud storage;

  • outcome monitoring;

  • payments;

  • event bookings; and

  • organisational records.

These providers may change as our organisation develops.

We will take reasonable steps to ensure that providers handling personal information offer appropriate data-protection and security safeguards.

​

12. International transfers

​

Some website, email, cloud-storage, social-media or technology providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal mechanism applies.

This may include:

  • UK adequacy regulations;

  • an International Data Transfer Agreement;

  • the UK International Data Transfer Addendum;

  • binding corporate rules; or

  • another safeguard or legal exception recognised under UK data-protection law.

Where required, we will assess whether the information will receive an appropriate level of protection following the transfer.

You may contact us for further information about the safeguards used for international transfers.

The ICO states that restricted transfers must be covered by adequacy regulations, appropriate safeguards or a recognised exception.

13. Cookies and similar technologies

​

Cookies are small files placed on your device when you visit a website.

Our website may use the following types of cookies.

Essential cookies

These are required for the website to operate securely and correctly.

They may support functions such as:

  • website security;

  • accessibility;

  • form submissions; and

  • remembering privacy choices.

These cookies do not normally require consent where they are strictly necessary for the service requested.

Analytics cookies

These help us understand how visitors use the website, such as which pages are visited and whether visitors experience technical problems.

Functional cookies

These may remember your choices or enable additional website features.

Marketing or third-party cookies

These may be used by embedded content, social-media features, advertising tools or other external services.

Where consent is required, non-essential cookies will not be activated until you have made a choice.

Our cookie controls should allow you to:

  • accept non-essential cookies;

  • reject non-essential cookies;

  • manage your preferences; and

  • change your choices later.

You can also control or delete cookies through your browser settings. Disabling some cookies may affect how parts of the website work.

Further information about the cookies used on our website, including their providers, purposes and duration, is available in our Cookie Policy and through our cookie-settings tool.

Consent to non-essential cookies must involve a clear positive action, and refusing consent should be as easy as accepting it.

​

14. Links to other websites and social media

​

Our website may contain links to third-party websites or social-media platforms, including:

  • Facebook;

  • Instagram;

  • LinkedIn; and

  • TikTok.

We are not responsible for the privacy practices or content of external websites.

When you follow an external link, the relevant organisation’s own privacy policy will apply.

Social-media platforms may collect information about your activity in accordance with their own terms and privacy policies.

​

15. Photographs, videos and personal stories

​

We will seek appropriate permission before using an identifiable person’s:

  • photograph;

  • video;

  • case study;

  • testimonial; or

  • personal story

for publicity, communications, evaluation or fundraising.

Where possible, people will be told:

  • how the material will be used;

  • where it may appear;

  • whether their name will be included; and

  • how they can withdraw permission for future use.

Withdrawal will apply to future use.

We may not always be able to remove material that has already been:

  • printed;

  • published;

  • included in a completed report; or

  • copied or shared by other people.

We will take particular care where publicity could reveal sensitive information about someone’s health, support needs or personal history.

​

16. Children

​

Our general services are intended for adults aged 18 and over unless a specific project states otherwise.

Our website is not designed to knowingly collect personal information directly from children.

Where work involving children or young people is introduced, we will provide appropriate privacy information and establish suitable consent and safeguarding arrangements.

17. How long we keep information

​

We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet applicable legal, safeguarding, insurance, contractual or funding requirements.

Retention periods vary depending on the type of record.

For example:

  • general website enquiries will normally be retained for up to 12 months after the enquiry has been resolved;

  • unsuccessful or inactive referrals and expressions of interest will normally be retained for up to 12 months;

  • unsuccessful recruitment applications will normally be retained for up to six months after the recruitment process has ended;

  • mailing-list information will normally be retained until you unsubscribe or the list is no longer used;

  • financial, accounting and contractual records will normally be retained for at least six years where required;

  • photographic, video and publicity consent records may be retained for as long as the relevant material continues to be used;

  • safeguarding records may be retained for longer where this is necessary, proportionate and consistent with our retention schedule;

  • participant and referral records will be retained in accordance with our approved organisational retention schedule; and

  • anonymised statistical or impact information may be retained indefinitely because it no longer identifies an individual.

These periods may be extended where information is needed in connection with:

  • a safeguarding matter;

  • a legal claim;

  • an investigation;

  • an insurance requirement; or

  • another lawful reason.

We regularly review the information we hold and securely delete, destroy or anonymise information that is no longer required.

​

18. How we protect information

​

We use reasonable organisational and technical measures to protect personal information from:

  • loss;

  • unauthorised access;

  • accidental disclosure;

  • misuse;

  • alteration; or

  • destruction.

These measures may include:

  • password-protected systems;

  • multi-factor authentication where available;

  • access restrictions;

  • secure storage;

  • staff and volunteer confidentiality requirements;

  • data-protection and safeguarding procedures;

  • secure disposal arrangements;

  • appropriate system security; and

  • limiting access to people who genuinely need the information.

No website, email system or online transmission can be guaranteed to be completely secure.

Please consider this before sending highly sensitive information by ordinary email or through a general website contact form.

​

19. Your data-protection rights

​

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • be informed about how your information is used;

  • request access to the personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete information in certain circumstances;

  • ask us to restrict how information is used;

  • object to certain uses of your information;

  • receive certain information in a portable format;

  • withdraw consent where processing is based on consent; and

  • not be subject to certain decisions made solely through automated processing where those decisions have a significant legal or similar effect.

We do not currently make decisions about individuals solely through automated processing.

These rights do not apply in every situation. Some information may need to be retained for legal, safeguarding or other legitimate reasons.

To exercise a right, contact us at:

Email: info@empowhercic.org
Address: 8 Cathedral Road, Cardiff, CF11 9LJ

We may need to confirm your identity before responding.

We will normally respond within one month. In certain circumstances involving a complex request or multiple requests, data-protection law may allow additional time.

You will not usually be charged for exercising your rights.

​

20. Data-protection complaints

​

You can make a complaint about how we have collected, used, shared, stored or protected your personal information by:

  • emailing info@empowhercic.org;

  • writing to us at 8 Cathedral Road, Cardiff, CF11 9LJ; or

  • using the contact or complaints form available on our website.

We will:

  • acknowledge your complaint within 30 days;

  • take appropriate steps to investigate it;

  • keep you reasonably informed about its progress; and

  • communicate the outcome without undue delay.

The requirement to provide a clear complaints route, acknowledge complaints within 30 days and respond without undue delay is now in force.

Please contact us first so that we have an opportunity to investigate and address your concerns.

​

You also have the right to raise a concern with the UK’s data-protection regulator:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information is available on the Information Commissioner’s Office website.

​

21. Changes to this Privacy Policy

​

We may update this Privacy Policy when our services, systems, legal responsibilities or working practices change.

The latest version will be published on our website with the date it was last updated.

Where appropriate, significant changes may also be communicated through our usual contact channels.

bottom of page