Privacy Policy

Who we are

Empathy Northwest CIC (“we”) is the data controller for the information you share with us. We are based at The Prudential Assurance Building, 16 Library Street, Wigan, WN1 1NN. We are registered at Companies House as Empathy North West CIC, company number 07964003. Our ICO data-protection registration number is ZA859552.

What we collect

When you contact us or complete our self-referral form, we may collect: your name and contact details (email and phone, and - only if you give them - your address and date of birth); who the support is for and what brings you to us; your availability and any preferences; and, if you choose to share them, your GP's details. The self-referral form also asks some optional health and circumstances questions (for example whether you have a disability or access needs), and a short, optional equal-opportunities section. You never have to complete the optional parts. We also keep records of our correspondence and, once you become a client, the notes relating to the support we provide.

Special category information

Some of what we collect is “special category” data under UK GDPR - information that needs extra protection. For us that means information about your health (why you're seeking support, and the optional health questions on the form) and, in the optional equal-opportunities section, your ethnicity and sexual orientation. We collect and use health information with your explicit consent. The equal-opportunities questions are entirely optional - you can leave them blank - and are used only to monitor and improve equality of access; we handle that information under the “equality of opportunity or treatment” provisions of the Data Protection Act 2018. We treat all of it with particular care, and you never have to share more than you're comfortable with.

Children and young people

We support children and young people as well as adults. Where someone is under 18 we take extra care with their information and follow our safeguarding and consent practices for young people. Depending on a young person's age and understanding, a parent or guardian may help arrange support and may exercise data-protection rights on their behalf; as a young person grows up, those rights increasingly become their own. If you have any question about how we handle a young person's information, please ask and we'll talk it through.

If you apply for a placement

If you apply for a training placement with us, we collect the information you put in the application form and your CV - for example your contact details, your training and experience, and your approach to the work - so we can consider your application. Our lawful basis is our legitimate interest in recruiting and running supervised placements; where your application or CV includes special-category information, we rely on your explicit consent to that. If your application isn't successful we keep it only as long as we reasonably need to, then securely delete it.

Donations and payments

If you make a donation through this website, you choose an amount here and are then taken to our payment provider, SumUp, to enter your card details and pay. Card details are entered directly with SumUp on their secure page: we never see or store them. We receive a record of the donation (the amount, a reference, the date, and a name if you choose to give one) for our accounts. If you donate to a fundraiser and give your name, it may be shown, with the amount, on that fundraiser's public supporters list; choose “anonymous” when you donate and no name is stored or shown. You can optionally give your email address so we can send a receipt; we use it only for that and for anything you ask us about your donation. SumUp handles your payment under its own privacy notice (sumup.com).

If you set up a regular donation (weekly, fortnightly or monthly), we create a customer record with SumUp that includes your email address, and SumUp securely stores a payment token so the agreed amount can be taken on that schedule: we still never see or hold your card number. We keep your name (if you give one), your email address and your gift's amount, schedule and status, so we can run the gift, send receipts and payment reminders where they apply, and include a link you can use to change or cancel it at any time. Regular gifts support our general fund only (they can't be pointed at an individual fundraiser), so your name never appears on a fundraiser's public supporters list because of one. You can stop your gift whenever you like.

Why we use it, and our lawful basis

We use your information to respond to you, arrange an initial conversation, and provide therapeutic support. Our lawful basis is your consent, and for health information, your explicit consent. You can withdraw consent at any time (see “Your rights”).

How long we keep it

We keep client records for five years after your case with us closes. Destruction is deliberate rather than automatic: our case-record system stamps that date on every closed case and flags when it falls due, and permanently destroying a record takes two managers to sign off, with the destruction itself logged. Only anonymous statistics that cannot identify you (things like age bands and outcomes) are kept beyond that. Donation and accounting records are kept for as long as company law requires (typically six years); anything else we keep only as long as necessary for the purposes described above.

Who can see it

Your information is kept confidential within our team and is never sold. We use a small number of trusted providers to run our service: our website host (Cloudflare), the provider that delivers our emails (Resend) and the inbox that receives your enquiry (Microsoft Outlook), and our payment provider (SumUp) for donations. Each one only handles the information needed for its part, under its own data-protection terms.

Confidentiality, and when we might need to share

What you share with us is treated as confidential and kept within our team. There are a small number of situations where we may need to share information without your consent: where there is a serious risk to your safety or someone else's, where there is a safeguarding concern (especially involving a child or an adult at risk), or where the law or a court requires it. Wherever we can, we will talk to you about this first. Outside of these situations, we will not pass your information on without your agreement.

Where it's stored and how it's protected

Information you send through this website travels over an encrypted (HTTPS) connection. A self-referral or placement application is also encrypted at the moment you submit it, and is only ever opened inside our own internal case-management system - a system that is not reachable from the public internet, where access is limited to authorised team members and every time a record is opened or changed is logged. Client notes and that log are kept append-only, so records cannot be quietly altered or deleted. Where any notes are kept on paper, they are stored securely at our premises. Some of the providers that help deliver the site and our email are based outside the UK; where data is processed there, the transfer is covered by standard data-protection safeguards such as standard contractual clauses.

Your rights

Under UK GDPR you have the right to access your information, correct it, ask us to delete it, restrict or object to how we use it, request a copy, and withdraw consent at any time. To exercise any of these, contact us at empathynorthwest@outlook.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

This website sets no cookies: no tracking, no analytics, and no non-essential cookies, so no cookie banner is needed. Our fonts are served from our own domain rather than a third party. If you choose to donate, the payment step is handled by our payment provider, SumUp - on SumUp's own page for a one-off gift, or through SumUp's secure card form shown on our card-setup page for a regular gift - and SumUp may set its own cookies as part of taking the payment, under its own privacy notice.

Technical data and security

Like any website, ours is delivered through a hosting provider (Cloudflare), which processes your device's IP address to serve pages securely and protect the site from abuse, for example limiting how often the contact form can be submitted. This happens under Cloudflare's own privacy terms. We don't use your IP address to identify or track you, we run no analytics, and it isn't stored alongside your enquiry or your donation.

Changes and contact

We may update this policy from time to time. It was last reviewed on 16 July 2026. For any questions about your information, contact us at empathynorthwest@outlook.com or on 0303 303 1333.