How we look after the information you share with us
Web version of our Privacy Notice (THN-DP-003), version 1.0, adopted by the Board on 5 October 2026. Updated on 31 October 2026 to add the section "Our website", and on 3 November 2026 to add the section "Surveys and feedback".
The Hearth Network CIC collects some information about the people who join our programmes, volunteer with us, work with us and sign up to hear from us. This notice explains what we collect, why, how long we keep it, and what you can ask us to do about it.
Four things are worth knowing up front:
The short version: treat other people's information the way you'd want yours treated. That is the rule we ask of everyone at The Hearth, and it is the rule we hold ourselves to.
The Hearth Network CIC is the "data controller" for the information described in this notice. That means we are the organisation legally responsible for deciding what is collected and what happens to it.
Organisation: The Hearth Network CIC
Company number: 16096200 — a Community Interest Company registered in England & Wales
Registered office: Suite 7 Roselands, 3 Cross Green, Formby, Liverpool, L37 4BH
ICO registration: ZC231936 — we are registered with the ICO, the UK regulator for data protection
Data Protection Lead: Rebecca Armstrong, Co-Director
Email: info@thehearthnetwork.co.uk
We are a small organisation. We are not required by law to appoint a Data Protection Officer, because we are not a public authority and we do not monitor people on a large scale or handle sensitive information on a large scale. Rebecca Armstrong carries out the data protection role for us, and is the person to contact about anything in this notice.
Personal information (the law calls it "personal data"): any information that identifies a living person, or could when put together with something else. Your name, your email address, a photograph of you, a note about your attendance.
Special category information: a short list of information the law treats as more sensitive, because getting it wrong causes more harm. It covers health, race or ethnic origin, religion or belief, politics, trade union membership, genetics, biometrics, sex life and sexual orientation. We handle two of these: health information and, occasionally, information you choose to tell us about your background.
Data controller: the organisation that decides what information is collected and what is done with it. For everything in this notice, that is us.
Data processor: a company that handles information on our behalf and under our instructions — for example the company that runs our email system. They cannot use it for their own purposes.
Lawful basis: the legal reason we are allowed to hold your information at all. There are seven to choose from since 5 February 2026, and we have to pick the right one for each thing we do. They are explained later in this notice.
UK GDPR and the Data Protection Act 2018: the two pieces of law that set the rules. They were amended by the Data (Use and Access) Act 2025, and this notice reflects those changes.
ICO: the independent UK regulator that enforces data protection law and that you can complain to. On 30 September 2026 the Information Commissioner's Office became the Information Commission. Nothing about its job changed, and it still calls itself the ICO — so that is what we call it here.
Most of what we hold is ordinary contact information — a name, an email address, sometimes a phone number — so that we can tell you when a session is happening and get in touch if plans change. On top of that we hold three kinds of thing that need more care: information about children and young people in our Forest School programme, health and emergency information for people attending outdoor sessions, and safeguarding records where there has been a concern about someone's safety. Those three are held more tightly, seen by fewer people, and kept for longer, because the law requires it.
We also keep attendance figures so we can tell our funders honestly what we did with their money. Wherever we can, we report those figures as totals with no names attached.
Name, email address, phone number, postcode. About: participants, volunteers, CASA members, contractors. Why: so we can run sessions, tell you about changes, and stay in touch about the work you signed up for. What allows us: legitimate interests — running our programmes. For contractors and formal volunteers, performance of a contract.
Emergency contact details. About: participants and volunteers at in-person sessions. Why: so we can reach someone quickly if you are taken ill or hurt. What allows us: legitimate interests, and vital interests in an emergency.
Health information, access needs, allergies, medication. About: participants who tell us they have a need. Why: so a session is safe for you to attend and we know what to do if something happens. What allows us: your explicit consent, given on the sign-up form. In a genuine emergency, vital interests.
Date of birth or age. About: children and young people aged 11 to 16 in Forest School. Why: to check a programme is right for their age, and for safeguarding. What allows us: recognised legitimate interest — safeguarding.
Parent or guardian name and contact details. About: parents and guardians of under-18s. Why: so we can obtain consent and reach a responsible adult. What allows us: legitimate interests.
Attendance and engagement records. About: all programme participants. Why: to understand what is working, and to report to funders. What allows us: legitimate interests. We report to funders in totals wherever we can.
Safeguarding records and concerns. About: children, young people and adults at risk. Why: because we have a duty to act when someone may be at risk of harm. What allows us: recognised legitimate interest — safeguarding a vulnerable individual (see below), together with the substantial public interest condition for the sensitive parts.
DBS certificate information. About: volunteers and staff in regulated activity. Why: safer recruitment — it is a legal requirement for some roles. What allows us: legal obligation and substantial public interest. Handled under our Appropriate Policy Document (THN-DP-002).
Photographs and film. About: anyone who agrees to appear. Why: to show the community what happens at our sessions, and to evidence our work to funders. What allows us: your consent, given separately and specifically. Always optional.
Business name, sector and sustainability information. About: CASA business network members. Why: to run the network and produce the member directory. What allows us: legitimate interests and performance of the membership arrangement.
Bank details and expense claims. About: volunteers claiming expenses, contractors. Why: to pay you, and to keep the accounts HMRC requires. What allows us: legal obligation, and performance of a contract.
Email address for our mailing list. About: anyone who signs up. Why: to send you news about what we are doing. What allows us: your consent. Every email has an unsubscribe link, and using it takes effect immediately.
Accident and incident records. About: anyone involved in an incident at a session. Why: because we must record them, and because our insurer may need them. What allows us: legal obligation and legitimate interests.
The law gives seven possible reasons for holding someone's information. We use six of them — everything except "public task", which is for public authorities.
Consent: you have said yes, freely and specifically, and you can say no without losing anything. We use consent for photographs, for our mailing list, and for health information you tell us. You can withdraw consent at any time by emailing info@thehearthnetwork.co.uk, and we will act on it straight away.
Performance of a contract: we have an agreement with you — a contractor agreement, a volunteer role, a CASA membership — and we need your information to keep our side of it.
Legal obligation: the law requires us to hold it. Financial records for HMRC, DBS checks for certain roles, accident records.
Vital interests: someone's life or safety is at immediate risk and there is no time to ask. We would use this to give a paramedic your medical information at a session. It is rare, and it is a last resort.
Legitimate interests: we have a genuine reason to hold the information, we have weighed that against your privacy, and we are satisfied it is fair and that you would expect it. We use this for running programmes, staying in touch and reporting to funders. You can object, and we have to stop unless we can show a compelling reason not to.
Recognised legitimate interest (safeguarding): this is new. Since 5 February 2026 the law lists a small number of purposes that Parliament has already decided are justified, so we do not have to carry out our own balancing exercise. One of them is safeguarding a vulnerable individual. Everyone under 18 counts automatically. An adult counts where we reasonably believe they have care and support needs, are at risk of harm or neglect, and cannot protect themselves as a result. We still have to show that what we are doing is necessary, and we record why.
What "legitimate interests" does not mean: it does not mean we can do whatever suits us. It means we have written down the reason, weighed it against your privacy, and would be able to show our working if the ICO asked. If you think we have got that balance wrong, tell us — that is exactly what the right to object is for.
Health information needs a second legal reason on top of the ones above. That is true even when we are handling it for safeguarding — the new safeguarding rule described above covers the ordinary information, but not the sensitive parts.
Where we hold health information because you told us about an access need, an allergy or a medical condition, we rely on your explicit consent. You give that on the sign-up form, it is always optional, and you can withdraw it at any time.
Where we hold sensitive information as part of a safeguarding record, or information about criminal offences through a DBS check, we rely on the substantial public interest conditions in Schedule 1 to the Data Protection Act 2018. The law requires us to keep a written document explaining how we handle that information. Ours is THN-DP-002, our Appropriate Policy Document, and you can ask us for a copy.
We do not ask anyone about their race, religion, politics, sexual orientation or trade union membership, and we do not record it. If you choose to tell us something like that in conversation, it stays a conversation. It does not go on a file.
Our Forest School programme is for young people aged 11 to 16, and children come to many of our community events with their families.
If you are a young person and you want to know what we hold about you, or want it deleted, you can ask us yourself. You do not need a parent to ask for you. Email info@thehearthnetwork.co.uk and we will write back in language that makes sense.
Photographs are how we show what happens at a session, and they matter to us. They are also entirely optional, and saying no to them never affects your place at anything.
This section explains what happens to your information when you use thehearthnetwork.co.uk or the booking and donation pages we link to.
Sometimes we ask people what they think of our work, for example in our Have your say survey. We use Microsoft Forms, part of our Microsoft 365 account, to collect the answers.
We share as little as possible, with as few people as possible. We never sell your information and we never pass it on for anyone else's marketing.
Partner organisations we deliver with: only what is needed for a specific piece of joint work, agreed in writing beforehand. Each organisation stays responsible for what it holds.
Funders: attendance and outcome figures. We report these as totals with no names attached wherever the funding agreement allows it. Where a funder requires individual-level information, we tell you before you sign up.
Safeguarding authorities — the local authority, the police, social services: information about a specific concern, where we believe someone is at risk of harm. We do this whether or not we have consent, because we have a duty to. Wherever it is safe to do so, we tell the person first.
Our accountants, ALS: financial records, including expense payments, for preparing our accounts and tax returns.
Our insurer: accident and incident records where a claim arises.
Companies that run our systems: Microsoft, for our email, files and forms. Our mailing list provider, for newsletters. Our project management system, for task records. GoDaddy, Eventbrite and Zeffy, as described under "Our website". They act on our instructions only and cannot use your information for their own purposes, except where their own privacy policy applies as described above.
One promise worth stating plainly: we will never share your information with anyone who does not genuinely need it. That includes other volunteers, other participants, and other organisations. "Need to know" is not a slogan for us — it is the rule every person at The Hearth signs up to.
Your information is held in our Microsoft 365 systems — SharePoint for documents, Outlook for email — and in the other systems listed above.
Some of the companies that run those systems are based outside the United Kingdom, or store information outside it. Where that happens, the law requires a safeguard to be in place so your information keeps the same protection it has here. We rely on the safeguards those providers put in place, which are the UK's approved contract terms or an adequacy decision covering the country concerned.
The short answer: no longer than we need to, and for most things that means three years after we last heard from you.
Two exceptions run much longer. Safeguarding records are kept for ten years, or until a child turns 25, whichever is later. Financial records are kept for seven years. Both of those are our own policy, set to sit comfortably above the legal minimums rather than at them.
Rebecca carries out a data audit every April, deleting what is past its date.
Safeguarding records: 10 years, or until the child turns 25 — whichever is longer. This is our policy, following recognised safeguarding practice; no statute sets a period. Records relating to an allegation of child sexual abuse are kept for 75 years, following the recommendation of the Independent Inquiry into Child Sexual Abuse.
Accident and incident records for children: 10 years, for liability.
Financial records and expenses: 7 years. This is our policy. The legal minimums are 6 years from the end of the financial year for HMRC, and 3 years for accounting records under the Companies Act 2006.
DBS certificate information: destroyed within 6 months of the recruitment decision, following the DBS Code of Practice. After that we keep only the certificate date, name, certificate type, role, certificate number and the decision taken.
Programme attendance and engagement: 3 years after the programme ends, for funder reporting and impact evidence.
General consent forms: 3 years after last contact, as proof that we were allowed to hold your information.
Photography consent forms: for as long as we use the image, plus 1 year, as proof of consent.
Volunteer records: 3 years after the role ends, for references.
Accident and incident records for adults: 3 years, for liability.
CASA business network records: duration of membership, plus 2 years, for continuity of the relationship.
Mailing list subscription: until you unsubscribe. Your consent is what keeps it there.
You have eight rights over the information we hold about you. Most of them you exercise simply by asking us. Email info@thehearthnetwork.co.uk and say what you want — you do not need to use any particular form of words, mention any law, or explain why.
We reply within one month. If your request is genuinely complicated, or you have made several at once, we can take up to three months in total — but we will tell you within the first month that we are doing so, and why. If we need to check who you are before we answer, the clock starts when we have what we need.
Asking costs nothing.
To be told: to know what we hold and what we do with it. This notice is how we do that.
To see it: to get a copy of everything we hold about you. This is often called a subject access request.
To have it corrected: if something we hold is wrong or incomplete, to have it put right.
To have it deleted: to have it erased — unless we have a legal reason to keep it. Safeguarding and financial records are the usual exceptions, and we will tell you if one applies.
To limit what we do with it: to have us pause using it — for example while you are disputing whether it is accurate.
To object: to tell us to stop using it where we are relying on legitimate interests. We must stop unless we can show a compelling reason not to. If you object to marketing, we stop, full stop — there is no balancing.
To take it with you: to receive the information you gave us in a format you can pass to someone else. This applies where we hold it on the basis of your consent or a contract, and where we hold it on a computer rather than on paper.
Not to be subject to automated decisions: we do not make decisions about anyone by computer alone, so this one does not arise. If that ever changes, we will say so here first.
Since 19 June 2026 the law gives you a right to complain directly to us, and gives us duties when you do. Here is exactly what happens.
You can also complain to the ICO, at any point. You do not have to complain to us first, and you do not have to wait for us to finish. The ICO will usually suggest raising it with us first, but that is their recommendation, not a rule you have to follow.
Website: ico.org.uk — complaints at ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL
A note on the name: on 30 September 2026 the Information Commissioner's Office became the Information Commission. Its powers and its job are unchanged, and it still calls itself the ICO.
We review this notice every year, and whenever the law or our programmes change. If we make a change that affects you meaningfully, we will tell you rather than quietly updating the page.
If anything here is unclear, or you would like it in a different format, email info@thehearthnetwork.co.uk and we will sort it out.
This notice was adopted by unanimous written resolution of the Board of Directors, reference THN-BR-2026/02, on 5 October 2026. All four Directors signed it electronically.
© 2026 The Hearth Network CIC. A community interest company limited by guarantee, registered in England and Wales, company number 16096200. Registered office: Suite 7 Roselands, 3 Cross Green, Formby, Liverpool, L37 4BH.