Privacy Policy
1. Who we are
Central Wellbeing Support (“CWS”, “we”, “us”) is the data controller for the personal information described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC067404. This policy is effective from 11th October 2026.
CWS helps employers across the UK make mental health and wellbeing an everyday conversation, meet their legal duties, and act proactively rather than reactively. Because of the nature of our work, we sometimes handle information about people’s mental and physical health, which the law treats as “special category” data. We take that responsibility seriously.
| Detail | Information |
| Legal name | Central Wellbeing Support Ltd Company number: 16294492 |
| Trading name | Central Wellbeing Support |
| Address | 3 Alison Avenue, Hucknall, Nottingham |
| kelly@cws.uk.com | |
| Phone | 0115 9191696 |
| Website | cws.uk.com |
| Data protection lead | Kelly Sinclair, who is responsible for data protection at CWS |
This policy applies to:
- Employers and organisations who buy or enquire about our services, and their staff contacts
- Employees and individuals who take part in our training, workshops, wellbeing sessions or one-to-one support
- Visitors to our website and people who follow or contact us on social media
- Suppliers, associates and partners we work with
This policy is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
2. The personal data we collect
We only collect what we genuinely need for the purpose involved. Depending on how you interact with us, this may include the following.
| Category | Examples | Who it relates to |
| Identity and contact | Name, job title, employer, work email, phone number | Client contacts, participants, suppliers |
| Service and booking | Sessions attended, training records, attendance, certificates issued | Participants |
| Feedback and evaluation | Survey and evaluation responses (anonymised wherever possible) | Participants |
| Financial | Invoicing details, purchase orders, payment records | Client organisations, sole-trader clients |
| Communications | Emails, messages, call notes, enquiries | Anyone who contacts us |
| Technical | IP address, browser type, pages visited, cookie data | Website visitors |
| Marketing | Your preferences and whether you have opted in or out | Contacts and subscribers |
Special category data
In delivering wellbeing support we may receive information about:
- Your mental or physical health, including stress, anxiety, low mood or other conditions you choose to share
- Personal circumstances that affect your wellbeing
- In some cases, other special category information you volunteer, such as religion, sexual orientation or ethnicity
We never ask for special category data unless it is necessary for the support you have asked for. You are never obliged to share it, and our support does not depend on you disclosing a diagnosis.
Criminal offence data
We do not routinely collect criminal offence data. If it is disclosed to us, we only record it where strictly necessary (for example, for safeguarding) and handle it under the conditions set out in Section 4.
3. How we collect it
Most information comes directly from you, for example when you:
- Enquire about or book our services by email, phone, our website or social media
- Completing tasks sent to you by your employer, these may include but are not limited to Health Decelrations, Questionnaires and Action plans
- Attend training, a workshop or a wellbeing session
- Take part in one-to-one or group support and choose to share information with us
- Complete a registration form, survey or evaluation
- Sign up to our newsletter or updates
We may also receive information from:
- Your employer, when they book you onto a session or refer you for support. We only accept referral information that is necessary, and we expect employers to have told you about the referral first.
- Booking or event platforms used to arrange sessions
- Publicly available sources, such as company websites or LinkedIn, for business contact details only
- Our website and analytics tools, through cookies (see Section 11)
4. Why we use it and our lawful bases
The law requires us to have a lawful basis for every use of personal data. For special category data we also need an additional condition under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018.
| Purpose | Lawful basis (Article 6) |
| Delivering services we have agreed with you or your employer | Contract, or legitimate interests where the contract is with your employer |
| Managing bookings, attendance and certificates | Contract / legitimate interests |
| Invoicing, accounts and tax | Legal obligation |
| Responding to enquiries | Legitimate interests |
| Evaluating and improving our services | Legitimate interests (using anonymised data wherever possible) |
| Sending marketing to business contacts | Legitimate interests, with an easy opt-out |
| Sending marketing to individuals | Consent |
| Non-essential website cookies and analytics | Consent |
| Safeguarding and responding to risk of harm | Legal obligation, vital interests or legitimate interests |
| Handling legal claims or complaints | Legitimate interests / legal obligation |
Conditions for special category data
We process health and other special category data only where one of these applies:
- Explicit consent (Article 9(2)(a)): our main condition for one-to-one wellbeing support. We ask for your clear agreement before recording health information, and you can withdraw it at any time.
- Employment obligations (Article 9(2)(b) and Schedule 1, Part 1, paragraph 1): where we help an employer meet its legal duties, such as reasonable adjustments.
- Health or social care (Article 9(2)(h)): where support is provided under the responsibility of a professional bound by a duty of confidentiality.
- Vital interests (Article 9(2)(c)): where someone’s life is at risk and they cannot give consent.
- Safeguarding (Schedule 1, Part 2, paragraph 18): to protect children and adults at risk.
- Legal claims (Article 9(2)(f)): to establish, exercise or defend legal claims.
Where we rely on Schedule 1 conditions, we keep an Appropriate Policy Document explaining how we comply, as required by the Data Protection Act 2018. It is available on request.
Withdrawing consent
Where we rely on consent, you can withdraw it at any time by contacting us. This does not affect anything we did lawfully before you withdrew it.
5. Confidentiality and its limits
What you share with us in wellbeing clinic support is confidential. We do not share your personal or health information with your employer unless you agree, or one of the exceptions below applies.
Where we report back to an employer, we use anonymised or aggregated information only, such as attendance numbers or overall themes, and never in a way that could identify an individual. Where a group is small enough that someone could be identified, we do not report on it.
When we may share without your consent
We may need to share information, without your agreement and sometimes without telling you first, if:
- We believe there is a serious risk of harm to you or someone else
- We have concerns about the safety of a child or an adult at risk
- We are required by law, for example by a court order
- It is needed to prevent or detect a serious crime, including terrorism
In these cases we share only what is necessary, only with the appropriate people (such as emergency services, a GP or the local authority safeguarding team), and we record what we shared and why. Where it is safe and appropriate, we will talk to you first.
We will explain these limits to you before any one-to-one support begins.
6. Who we share data with
We never sell your personal data, and we never share it for other organisations’ marketing.
We use a small number of trusted service providers (“processors”) who handle data on our behalf, only on our instructions and under a written contract that meets UK GDPR Article 28.
| Type of provider | Purpose | Example |
| Email and cloud storage | Communication and secure file storage | [e.g. Microsoft 365 / Google Workspace] |
| Accounting software | Invoicing and bookkeeping | [e.g. Xero / QuickBooks] |
| Website hosting and forms | Running our website and enquiry forms | [e.g. Wix / Squarespace / WordPress host] |
| Video conferencing | Delivering online sessions | [e.g. Zoom / Microsoft Teams] |
| Email marketing | Sending newsletters to subscribers | [e.g. Mailchimp] |
| Booking platform | Managing event and session bookings | [e.g. Eventbrite / Calendly] |
We may also share information with:
- Associates or freelance practitioners who deliver services for CWS, bound by confidentiality and data protection agreements
- Professional advisers such as our accountant, insurer or solicitor, where necessary
- Regulators, police, courts or safeguarding authorities, where the law requires it or as described in Section 5
- A buyer or successor, if CWS is ever sold or restructured, under the same protections
International transfers
We aim to keep personal data in the UK or European Economic Area. Some providers may store data elsewhere, such as the USA. Where this happens, we make sure the transfer is protected by a UK adequacy decision (including the UK–US Data Bridge), the ICO’s International Data Transfer Agreement or Addendum, or another lawful safeguard. You can ask us for details.
7. How we keep data secure
We use technical and organisational measures appropriate to the sensitivity of the data we hold, including:
- Encrypted, password-protected devices and accounts with multi-factor authentication
- Access to health and support notes restricted to the people who need it
- Secure, encrypted video platforms for online sessions
- Separate storage of identifiable support notes from general business records
- Paper records (if any) kept in a locked cabinet and shredded securely when no longer needed
- Confidentiality agreements and data protection training for anyone working with us
- Regular software updates, antivirus protection and secure backups
If something goes wrong
We have a procedure for handling personal data breaches. Where a breach is likely to put your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it. Where the risk to you is high, we will also tell you without undue delay.
8. How long we keep data
We keep personal data only as long as we need it, then delete or anonymise it securely.
| Type of record | How long we keep it | Why |
| One-to-one support notes and health information | [6] years after support ends | Professional standards and possible legal claims |
| Safeguarding records | Up to [7] years, or longer where legally required | Protection of individuals and legal duty |
| Training attendance and certificates | [3] years after the course | Evidence of training for you and your employer |
| Client contracts and correspondence | 6 years after the contract ends | Limitation period for contract claims |
| Financial and invoicing records | 6 years from the end of the financial year | HMRC requirements |
| Enquiries that do not become work | [12] months | Follow-up of your enquiry |
| Marketing lists | Until you unsubscribe, reviewed every [2] years | Consent and legitimate interests |
| Survey and evaluation data | Anonymised straight away; identifiable data deleted within [12] months | Service improvement |
| Website analytics | Up to [14] months | Analytics provider settings |
Where support relates to a child or young person, records may be kept until they reach age 25 or for the period above, whichever is longer.
9. Your rights
Under UK data protection law you have the right to:
| Right | What it means |
| Be informed | Know how your data is used, which this policy explains |
| Access | Get a copy of the personal data we hold about you |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Ask us to delete your data in certain circumstances |
| Restrict processing | Ask us to limit how we use your data |
| Data portability | Receive your data in a portable format, or have it sent to another organisation |
| Object | Object to processing based on legitimate interests, and to direct marketing at any time |
| Withdraw consent | Withdraw consent at any time where we rely on it |
| Automated decisions | Not be subject to decisions made solely by automated means (we do not make any) |
Some rights do not apply in every situation. For example, we may need to keep safeguarding records even if you ask us to delete them. If we cannot meet a request, we will explain why.
How to make a request
Contact us at kelly@cws.uk.com. You can ask verbally or in writing. We may need to confirm your identity before responding.
We will respond within one month. If your request is complex, we may extend this by up to two further months, and we will tell you why within the first month. There is normally no charge.
10. Children and young people
Our services are designed for adults in the workplace. We do not knowingly collect data from anyone under 18 without the involvement of a parent, guardian or responsible organisation.
If we work with young people, for example apprentices under 18, we take extra care, apply our safeguarding procedures, and write any information for them in clear, age-appropriate language.
11. Cookies, marketing and automated decisions
Cookies
Our website uses essential cookies to work properly. With your consent, we may also use analytics cookies to understand how visitors use the site. Non-essential cookies are only set after you agree through our cookie banner, and you can change your choice at any time.
Marketing
We will only send you marketing if you have opted in, or if you are a business contact and we have a legitimate interest in telling you about similar services. Every message includes a simple way to unsubscribe. We never use health information for marketing.
Social media
If you interact with us on platforms such as LinkedIn, Facebook, Instagram, X, or TikTok those platforms also process your data under their own privacy policies. Please do not share personal health information with us through public comments; contact us privately instead.
Automated decision-making
We do not make decisions about you based solely on automated processing, and we do not use profiling that has legal or similarly significant effects.
12. Complaints, changes and contact
Complaints
If you are unhappy with how we have handled your data, please contact us first at kelly@cws.uk.com and we will try to put it right.
You also have the right to complain to the Information Commissioner’s Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this policy
We review this policy at least once a year and whenever our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell you directly where appropriate.
Contact us
For any question about this policy or your data, contact Kelly Sinclair, Central Wellbeing Support, at kelly@cws.uk.com or 0115 9191696.
