Service User and Website Privacy Notice

Who we are

SHIFTwithin CIC is a Community Interest Company based in Kent, UK, delivering trauma-informed, holistic programmes to women and children navigating separation, divorce, and relationship challenges. We are committed to protecting the privacy and personal data of all service users, website visitors, and stakeholders.

This Privacy Notice explains how and why we collect, use, store, and protect your personal information, in line with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The information we collect

We collect and process personal data that is necessary for us to provide our services, communicate with you, and operate our website. This may include:

  • Personal contact details such as name, addresses, telephone number and email address

  • Date of birth

  • Next of kin and emergency contact information

  • Sex (for operational, safeguarding and statistical purposes)

  • Information you provide in registration or feedback forms

  • Details of your interactions with SHIFTwithin CIC (e.g., attendance at programmes, feedback, correspondence)

  • IP address and website usage data (when you visit our website)

  • Any other information you choose to share with us in the course of our work

We do not collect more information than is necessary for the purposes set out in this notice.

Special category data

We may also collect, record and hold the following ‘special categories’ of more personal sensitive information, only with your explicit consent and when there is a lawful basis to do so.

  • Information you share with us about your health and wellbeing, including information about any medical conditions or disabilities you may have, and information about your mental health and wellbeing

  • Information you share with us about your personal situation / experiences

  • Information you share about your sexuality, race, or ethnicity

  • Information you share with us about any risks to your safety, or the safety of a child or other adult

We do not collect data on gender identity, as our services are designed for women and children based on sex as defined in UK law.

Please note:  We do not ask for medical information for any other reason than to be able to inform emergency services about this if ever required.  If a woman becomes unwell at SHIFTwithin CIC events / activities,  we will organise emergency medical care as appropriate.  Staff at SHIFTwithin CIC are not medically qualified and cannot administer medication or advise on medical conditions.

Website visitors

In addition to these categories mentioned above, as you interact with our website, we will automatically collect the following categories of technical information:

  • Internet protocol (IP) address

  • Browser type and version

  • Information about how you use our website

  • Other technology on the devices you use to access this website.

We collect this personal data by using cookies and other similar technologies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

How we use your information

We use your personal data to:

  • Provide and administer our programmes and services

  • Communicate with you about our services, events, and updates

  • Monitor and evaluate our work for quality improvement and reporting to funders (using anonymised or aggregated data where possible)

  • Fulfil our legal and safeguarding obligations

  • Maintain records as required by law and good practice

  • Respond to your enquiries, requests, or feedback

  • Ensure the security and integrity of our services and website

We will always explain the reason for collecting your data and will not use it for purposes incompatible with those stated.

Lawful basis for processing

We process your personal data on one or more of the following legal bases:

  • With your consent

  • To fulfil a contract or agreement with you

  • To comply with legal or regulatory obligations

  • To protect your vital interests or those of another person

  • For our legitimate interests (e.g., service improvement, safeguarding), provided these do not override your rights and freedoms

How we store and protect your data

  • Electronic data is stored on password-protected systems.

  • Paper records are kept in a locked filing cabinet in a secure office.

  • Access to personal data is restricted to staff who need it for their role.

  • Data is retained for no longer than three years, after which it is securely destroyed.

  • We have procedures in place to respond to data breaches or misuse.

Sharing your information

We do not sell or share your personal data with third parties for marketing purposes. We may share information only:

  • With your explicit consent

  • With trusted partners (e.g., schools, funders) when necessary for service delivery, and only on a need-to-know basis

  • Where required by law, safeguarding, or regulatory obligations

Where possible, we will anonymise or aggregate data before sharing.

Your rights

You have the right to:

  • Be informed about how your data is collected and used

  • Access the personal data we hold about you

  • Request correction or erasure of your data

  • Restrict or object to certain processing

  • Withdraw consent at any time (where processing is based on consent)

  • Make a complaint to the Information Commissioner’s Office (ICO)

To exercise your rights or make a subject access request, contact Kim Rojas Powell at kim@shiftwithin.co.uk

Changes to this Notice

We may update this Privacy Notice from time to time. The latest version will always be available on our website.
Review Date: March 2026