Privacy Policy

Last updated: 14 August 2026

This Privacy Policy explains how The Bridge to Freedom through Models of Recovery ("we", "us", "our") collects, uses, stores and protects your personal data when you use our website or contact us about our charitable work.

We are committed to protecting your privacy and handling your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (data controller)

The data controller responsible for your personal data is:

If you have any questions about this policy or how we use your data, please contact us using the details above.

2. What personal data we collect

Depending on how you interact with us, we may collect:

  • Identity data - name
  • Contact data - email address and telephone number
  • Enquiry data - the type of enquiry and the content of your message
  • Technical data - IP address and basic server log information when you submit a form (for security and abuse prevention)
  • Communication data - records of emails, calls or other correspondence relating to your enquiry

Our work can involve special category data (for example, health or addiction) and information about criminal convictions. Please do not send those details through this website form. We will only collect that information later, through a safer route, where it is necessary to provide support and where the law allows us to do so.

3. How we collect your data

  • When you complete our website contact form
  • When you email us or complete our website contact form
  • When you leave a review or interact with us on social media or a Google Business Profile
  • When you take part in our programme, refer someone, volunteer, partner with us or make a donation

Our website is not designed to place non-essential tracking cookies. If we introduce analytics or marketing cookies in future, we will update this policy and, where required, obtain your consent.

4. Why we use your data (purposes and lawful bases)

Under UK GDPR we must have a lawful basis for processing personal data. We use your information for:

  • Responding to enquiries and referrals - lawful basis: legitimate interests (to run the charity and respond to people who contact us) and/or steps prior to entering an agreement where you ask for support or to volunteer.
  • Providing charitable support - delivering the Community Resettlement Programme and related help (lawful bases: legitimate interests and, where relevant, vital interests).
  • Special category and criminal offence data - only where needed to provide support, and only with an additional condition under UK data protection law (typically explicit consent, or substantial public interest in the provision of confidential counselling, social care or safeguarding, as applicable). We will explain this if it becomes relevant.
  • Safeguarding and legal obligations - keeping records required for safeguarding, charity law, tax or legal claims (lawful bases: legal obligation and/or legitimate interests).
  • Website security - preventing spam and abuse of our contact form (lawful basis: legitimate interests).

Where you tick the consent box on our contact form, you are confirming that you wish us to contact you about that enquiry. You may withdraw consent for marketing communications at any time by contacting us (we do not currently send bulk marketing emails).

5. Who we share your data with

We do not sell your personal data. We may share it only where necessary with:

  • Service providers who help us operate (for example, email and hosting providers on cPanel, IT support)
  • Professional advisers such as insurers, accountants or legal advisers where required
  • Partner agencies (housing, health, probation or similar) only with your agreement, or where the law requires it
  • Authorities where we are legally required to do so, including safeguarding or crime-prevention duties

Any third parties processing data on our behalf are expected to do so only under our instructions and with appropriate security measures.

6. International transfers

We aim to store and process personal data within the United Kingdom. If any provider processes data outside the UK, we will ensure appropriate safeguards are in place as required by UK data protection law (for example, UK adequacy regulations or the UK International Data Transfer Agreement / Addendum).

7. How long we keep your data

We keep personal data only for as long as needed for the purposes above:

  • General enquiries that do not lead to support - typically up to 12 months
  • Programme and referral records - for the duration of support and then as needed for safeguarding, insurance and legal or accounting requirements (often up to 6 years)
  • Server / security logs related to form submissions - for a limited period for security monitoring

When data is no longer required, we will delete or anonymise it securely where practicable.

8. How we protect your data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse. This includes using secure hosting, restricting access to communications, and asking you not to send sensitive details through the website form.

No method of transmission over the internet is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

9. Your rights under UK GDPR

You have the following rights in relation to your personal data (subject to certain legal exemptions):

  • Right of access - to request a copy of the personal data we hold about you
  • Right to rectification - to have inaccurate or incomplete data corrected
  • Right to erasure - to request deletion in certain circumstances ("right to be forgotten")
  • Right to restrict processing - to limit how we use your data in certain cases
  • Right to data portability - to receive certain data in a structured, commonly used format
  • Right to object - to object to processing based on legitimate interests
  • Rights related to automated decision-making - we do not use automated decision-making or profiling that produces legal or similarly significant effects

To exercise any of these rights, contact us using the details in section 1. We may need to verify your identity before responding. We aim to respond within one month.

10. Children

Our programme is aimed at adults. We do not knowingly collect personal data from children through this website. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Third-party links and maps

Our website may link to third-party services such as Google Maps or Facebook. Those services have their own privacy policies. We are not responsible for their content or practices. Using those services may involve sharing data with the third party according to their terms.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the matter.

You also have the right to lodge a complaint with the UK supervisory authority:

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will change when we do. Please review this page periodically. Continued use of our website after changes constitutes awareness of the updated policy where permitted by law.

14. Contact

For privacy enquiries, email info@thebridgetofreedom.co.uk.

Back to contact