General
Space2BHeard CIC (S2BH) is committed to complying with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Looking after personal information you share with us is very important, and we want you to be confident that your personal data is kept safely and securely and to understand how we use it. We have produced this policy to help you understand
• how and why S2BH collect information from you
• how S2BH store and dispose of information from you
• what your rights are
If we make changes to this policy we will notify you by updating our privacy statement on our website.
S2BH will be what is known as the ‘Data Controller’ of the personal data you provide to us, and we will sometimes refer to ourselves in this notice as ‘we’ or ‘us’. By Data Controller, this means that S2BH determines the purposes and way in which any personal data are, or will be, processed.
This privacy policy was last updated in May 2025.
If you have any questions regarding this policy, please contact our Information Governance Lead, using the following details:
Information Governance Lead, Space2BHeard, 267 Beverley Road, Hull, HU5 2ST
Email: hello@s2bh.org
This policy applies to information we collect about:
• Visitors to our website
• People who use our services
• Job applicants and our current and at times former employees
• Self employed therapists
• Clients referred in from external services e.g. Hull Talking Therapies, Hull City Council
• Any other information that you may choose to send to us
• Third party suppliers
Information we collect and what we use it for
Visitors to our websites
When someone visits our Site, we collect standard internet log information and details of visitor behaviour patterns, we do this to find out things such as the number of visitors to the various parts of our site. We collect this information in a way that does not identify anyone. The exception to this is logging into the member’s area, where there is a need to identify our members.
We may use your personal information to monitor and improve our website. By using our website, you agree to the collection and use of information in accordance with this policy. You may request that S2BH remove your identifiable information from our records at any time. In these instances, we will endeavour to consider each request on a case by case basis and try to remove your data.
The S2BH website comprises http://www.s2bh.org
While using our Site, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to your name, email address and contact phone number. This can be when you are booking something or submitting an enquiry through our website for example.
Use of cookies by S2BH
Cookies are files with small amounts of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a web site and stored on your computer’s hard drive.
Like many sites, we use “cookies” to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Site.
Search engine
Search queries and results are logged anonymously to help us improve our website and search functionality, no user-specific data is collected by either S2BH or any other third party.
People who use S2BH online services
S2BH offer various services to its service users, staff, partners and other key stakeholders:
• Event booking
• S2BH presence on social media platforms such as Facebook, Instagram and LinkedIn
• Counselling and therapeutic services
All of the services we provide are run in their entirety by S2BH, or in partnership with organisations that S2BH subcontracts to such as CHCP.
Where possible, we do not request personal identifiable information unless it is necessary for the functionality of the service being provided. We will not request more information than necessary to supply the service. We will only use details to provide the service the person has requested and for other closely related purposes.
When financial transactions take place online, personal details such as name and address are stored on the S2BH financial systems.
Online Promotions
For events we sometimes use speakers names and photos to promote events – this is usually done with their approval but on occasions we take information from their website and use that. If this happens then we contact the speakers prior to using the information and inform them of this. This information is kept afterwards for reference only to evaluate the effectiveness of different promotional tools.
People Who use our Services
When you use S2BH counselling and therapeutic services we store your Clinical Notes on our Client Information System. The information sorted will include the following:
• Personal Contact information
• GP Contact Information
• Assessment Information
• Clinical Contact information including clinical notes, risk assessment, dates of appointments and data collected at sessions.
• Discharge information
• This information is highly protected and only accessible by those with involvement in the service users treatment pathway.
People who telephone us
When we receive a call from or about an S2BH referral, we may record the details of the call in the ‘messages’ section of the referrals database record, to allow us to administer your referral.
People who email us
Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Your emails will be stored by the relevant departments in accordance to the S2BH information lifecycle policy. When we receive an email from or about an S2BH referral, we may record the details of the email to allow us to administer your referral.
Communications
We may use your personal information to contact you with newsletters, marketing or promotional material.
Complaints about S2BH
All complaints about S2BH are treated seriously and we will only use the personal information we collect to process the complaint and to check on the level of service we provide.
Complaints about our members
S2BH has a strict complaints and conduct process. In order to process a complaint it is necessary to obtain certain details, which will usually include some personal information. We need to process this information as part of our regulatory role, and may need to keep the information even if the complaint is subsequently withdrawn. We usually have to disclose the complainant’s identity to the members concerned. However, there are occasions when we can take anonymous complaints. Usually, if we find that we can independently verify the allegations. We always ask for consent from the complainant from the outset to disclose their identity to the member. Without consent, the complaint would be considered as a third party complaint and processed in this way. We will keep personal information in a safe place and access is restricted according to the ‘need to know principle’.
Occasionally, requests may be made for further information about complaints, for example from organisational members or employers. The requests will be considered on their individual merit, proportionately and whether it is in the legitimate interest of public protection. Any disclosure will be communicated to the parties in advance, except where prohibited by law.
Self Employed Staff Information
As part of the S2BH Consultancy Agreements with Self Employed Staff we annually update their personal information and credentials. This is via email. We will ask members to review the information we already hold about them to inform us of any changes. This includes:
• Name
• Home address
• Telephone number
• Personal email address
• Certification
• Memberships
• Training updates
Job applicants, current / former employees, committee members and the Board of Directors members
When individuals apply to work or take up a position at S2BH, we will only use the information they supply to us to process their application.
Personal information about unsuccessful candidates will be held for 6-12 months after the recruitment exercise has been completed. It will then be destroyed or deleted. We share the bank details, pension information and HMRC information of all staff members with a third party who processes salary payments and expenses. We also hold the bank details of our employees to ensure salaries are paid promptly within our payroll services.
Special category data
Note that in some cases we may process “special categories” of personal data, and information about criminal convictions and offences. For example:
• Information in relation to our employees (such as health data), which is necessary for the performance of our contract with them or under employment law
• Information in relation to our staff and self employed consultants (for example, whether they have criminal convictions) which is necessary to uphold high standards in the profession and to protect the public
• Information provided by complainants (such as health data, sexuality), which is necessary in order to process complaints.
We take particular care of this information, using appropriate security measures, including limiting who has access to such information.
Lawful processing of personal data
S2BH will only process your personal data in accordance with one of the conditions for lawful processing set out in the GDPR. The main ways in which we process data are as follows:
• Processing on the basis of consent
• Processing is necessary for the performance of a contract
• Processing based on “legitimate interests”
Consent – When new contact S2BH, they may be asked if they would like to receive further information about our services. You have the right to consent to this. You can withdraw your consent at any time by contacting S2BH at Hello@S2BH.org
Contract – In order to perform our obligations to our service users, we need to process their personal data to ensure their care pathway at S2BH is efficient, safe and effective.
Legitimate interests – Where it is necessary to process personal data for our purposes as an organisation (our “legitimate interests”), we may do so provided that this does not override the rights and freedoms of the person whose data we are processing. S2BH exercises some functions where it is necessary to process personal data for the performance of its regulatory and public protection functions (such as the processing of complaints). In these cases, S2BH may rely on its legitimate interests as a body set out to promote and maintain high standards in the profession. In some cases, there will be some prejudice to the rights and freedoms of service users who are subject to complaints, as they may be subject to an adverse decision. However, any such prejudice will be outweighed by S2BH’s legitimate interests in maintaining high standards in the profession and protection of the public
Where it is necessary to use personal data to provide services and explicit consent has not been provided, we will rely on our legitimate interests in providing the services to further our organisation’s aims, provided they are not outweighed by the rights and freedoms of those using the services.
Retention of data
Information about how long we keep the personal data of members is set out in our Information Lifecycle Policy, available on request by contacting us.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Recipients of personal data
In addition to bodies mentioned in this policy, we may occasionally need to transfer personal data to other organisations, including:
• Current, past or future employers [for example, in relation to a request for references]
• Healthcare, social and welfare advisors or practitioners
• Education, training and accrediting establishments and examining bodies
• Employees and agents of the S2BH
• Suppliers, providers of goods and services
• Persons making an enquiry or complaint (For example with an organisational member or another regulatory body)
• Police forces (For example if a criminal investigation is being carried out involving one of our registrants)
• Central government
• Voluntary and charitable organisations
• Ombudsmen and regulatory authorities
We will ensure we have a legal basis for any such transfers before doing so.
Security
We will respect your confidentiality and will keep the information about you confidential. We store it securely and control who has access to it.
We will only share such information as necessary, and where we are satisfied that a third party is entitled to receive it and they will keep your information confidential and secure.
The security of your Personal Information is important to us, but remember that no method of transmission over the internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.
Other websites
If you transfer to another website from a link within the S2BH website, this privacy notice does not apply. We recommend you examine all privacy statements for all third party websites to understand their privacy procedures.
Your rights
Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
If you would like access to your personal data or to make a complaint please contact us at hello@s2bh.org or via telephone on 01482 705023.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Changes to this privacy notice
We aim to keep this notice under review to reflect changes to law or practice.
