1. Who we are 

Platfform is a registered charity working to change the story around mental health, transform the systems there to help, and create the conditions for people, communities, and organisations to thrive. Platfform is the data controller for personal data collected through our websites, related online services and online forms covered by this policy. 

This privacy policy applies across Platfform’s public-facing websites and related online services. Where a particular website, form, campaign, or service has more specific privacy information, that more specific information also applies. 

If you need to contact us about this policy or about your personal data, you can email dpo@platfform.org or write to Platfform, Beaufort House, Beaufort Road, Swansea, SA6 8JG. 

2. What this policy covers 

This policy explains how we collect, use, share and protect personal data when people use our websites, complete online forms, sign up for updates, make enquiries, interact with our campaigns, donate, or use website features such as contact, booking or payment-related forms. Certain services, forms, campaigns or website journeys may provide additional privacy information where something more specific applies. 

This policy should be read alongside any cookie information and any just-in-time privacy information provided at the point you use a form, sign up for updates, donate, make a booking, or manage cookie preferences on one of our websites. 

3. The personal data we collect 

Information you give us directly 

Depending on what you do on our websites, we may collect your name, email address, phone number, the content of messages or form submissions, marketing preferences, and information submitted through service enquiry, booking or payment journeys where relevant to the service requested. 

Please do not include sensitive personal information in general website forms unless we specifically ask for it. 

Information we collect automatically 

When you use our websites, we may automatically collect technical and usage information such as your IP address, browser type, device information, pages viewed, and how you move around the website. We may collect this information through cookies and similar technologies. 

4. How we use personal data 

We may use personal data to respond to enquiries, provide or support website services, manage bookings, appointments, donations, payments or follow-up linked to a requested service, improve website performance and usability, understand how people use our websites through analytics and reporting, measure the success of campaigns and communications, send newsletters or other direct electronic updates where lawful, and keep records needed for legal, safeguarding, security, governance or regulatory purposes. 

We do not sell personal data. 

5. Our lawful bases for using personal data 

Depending on the activity, we rely on one or more of the following lawful bases under UK GDPR: 

Legitimate interests, to run, maintain, secure and improve our websites, respond to enquiries, understand website use, and manage ordinary website administration. 

Consent, where required for non-essential cookies and similar technologies, and for email newsletters or other direct electronic updates where you opt in. 

If we rely on consent, you can withdraw that consent at any time, for example by changing your cookie preferences or unsubscribing from emails. 

Contract, where you ask us to take steps before entering into a contract, or where processing is needed to provide a paid or requested service such as booking-related activity. 

Legal obligation, where we must keep or disclose information to meet legal or regulatory duties. 

Vital interests may apply only in limited and exceptional cases, for example where information is needed to protect someone’s life or safety. 

Where we process special category data in connection with a specific support or safeguarding-related service, we will also identify and explain the relevant Article 9 condition, which may include substantial public interest where the law allows. We will explain this in the relevant form, service notice, or other just-in-time privacy information. 

Direct electronic marketing. We may send you electronic marketing about Platfform’s charitable purposes where UK law allows us to do so. This may be because you have given consent, or because the charitable purpose soft opt-in applies. Where we rely on the charitable purpose soft opt-in, this means you have expressed an interest in, or offered support for, our charitable purposes, we collected your contact details in that context, and you were given a clear opportunity to opt out when your details were collected and in every later message. You can opt out at any time. 

6. Special category data 

Some website journeys, especially those linked to wellbeing, counselling, support or safeguarding-related services, may involve information about health or wellbeing or other special category data. This kind of information needs extra protection under data protection law. 

We only collect special category data through website forms or online journeys where this is necessary for the relevant service, safeguarding function, or support process. Where we do so, we will explain the lawful basis, the Article 9 condition, whether providing the information is optional or required, and any additional safeguards and retention arrangements that apply. 

7. Cookies, analytics and similar technologies 

We use cookies and similar technologies for website operation and, where applicable, for preferences, statistics, booking or payment functions, and other online services. Where consent is required, we will ask for it before using the relevant technology. Our cookie information for each site explains the cookies and similar technologies used, their purpose, their duration, and how you can manage your choices. 

Depending on the site or service being used, these technologies may include website analytics tools, heatmapping or behavioural analysis tools, conversion tracking tools, pop-up or form optimisation tools, and tools linked to booking, donation or payment journeys. 

8. Who we share personal data with 

We use third-party providers to support the operation of our websites and related services. These providers may process personal data on our behalf so they can deliver hosting, forms, analytics, communications, donations, booking support, payment-related functions, or campaign measurement. Some of these providers may also set or support cookies or similar technologies used on our websites. 

We do not permit processors acting on our behalf to use personal data collected through our websites for their own marketing purposes. 

Where needed, we may also share personal data with professional advisers, regulators, safeguarding authorities, law enforcement, courts or other public authorities where there is a lawful reason to do so. 

9. International transfers 

Some third-party providers may process personal data outside the United Kingdom. Where this happens, we use appropriate safeguards recognised by UK data protection law, such as adequacy regulations, Standard Contractual Clauses together with the UK Addendum, or an International Data Transfer Agreement. You can contact us if you would like more information about those safeguards. 

10. How long we keep personal data 

We keep ordinary website enquiry data only for as long as needed to deal with the enquiry and related administration. This will normally be up to 12 months. 

If your enquiry, referral, booking, complaint, or form submission becomes part of a service user record, safeguarding record, donation record, finance record, or other operational record, we keep it in line with the retention period for that record type. Some records linked to health, support, safeguarding, or children’s services are kept for significantly longer. Where a more specific retention period applies, we will explain this in the relevant form, service notice, or just-in-time privacy information. 

11. How we protect personal data 

We use appropriate technical and organisational measures to protect personal data. This includes secure hosting where appropriate, restricted access to personal data, staff training, confidentiality requirements, and security controls for systems and providers. 

No website, system or internet transmission is completely secure. We work to reduce risk, but we cannot guarantee absolute security. 

12. Children and young people 

Where a website, form or service journey is specifically aimed at children or young people, or is likely to be accessed by them, we will provide privacy information in language suited to their age and understanding. Where appropriate, we may provide a separate child-friendly notice and additional bite-sized explanations at the point personal data is collected or used. Where required, we will design relevant online services in line with the ICO Children’s Code. 

13. Your rights 

You have rights over your personal data. These include the right of access, the right to correct inaccurate data, the right to request deletion, the right to restrict how data is used, the right to object to processing based on legitimate interests in certain circumstances, the right to object to direct marketing, the right to data portability where applicable, and the right to withdraw consent where consent is the basis for processing. 

To exercise your rights, contact dpo@platfform.org. 

14. Automated decision-making and profiling 

We do not carry out automated decision-making or profiling through our websites. 

15. Complaints 

If you have a concern about how we use your personal data, our cookies, or similar technologies on our websites, please contact us first via our data protection complaint form [Platfform Data Protection Complaint], by email at dpo@platfform.org, by post, or by telling a member of staff in person. We will acknowledge your complaint within 30 days and deal with it without undue delay. 

You also have the right to complain to the Information Commissioner’s Office. Details of how to do this are available on the ICO website. 

16. Changes to this policy 

We may update this privacy policy from time to time to reflect changes in law, guidance, our services, or the technology used on our websites. The current version will always be published on the website with a clear effective date. 

17. Contact details 

If you have any questions about this privacy policy or how we use personal data, contact dpo@platfform.org or write to Platfform, Beaufort House, Beaufort Road, Swansea, SA6 8JG. 

Last update:  10th June 2026