How we protect your information.

Last reviewed: September 2026 · Next review: September 2027

1. Information we collect

We may collect information when you contact us, apply for a funded programme, are referred to us, or attend a programme. This can include contact details, referral information, eligibility information and basic attendance records.

2. Sensitive wellbeing information

We only ask for information needed to assess eligibility, arrange support and meet safeguarding or funding responsibilities. Counselling records are managed separately by the responsible counsellor in line with professional obligations and the BACP Ethical Framework.

3. How information is used

To respond to enquiries and assess programme eligibility
To arrange sessions and communicate about attendance
To deliver appropriate wellbeing support
To meet safeguarding, legal and CIC reporting obligations
To report anonymised outcomes to funders and improve programmes

4. Lawful basis

Depending on the context, we rely on consent, legitimate interests, contractual necessity, vital interests or legal obligations. Where special-category health information is processed, we identify an appropriate additional condition under UK GDPR.

5. Sharing information

Information may be shared with the counsellor or delivery professional responsible for your support. We may share anonymised statistics with funders. Information is not sold or shared for third-party marketing. We only communicate with a referrer or health professional with a lawful basis and, where appropriate, your knowledge or consent.

6. Retention and security

Records are kept only as long as necessary for service delivery, professional obligations, safeguarding and reporting. Counselling records may be retained for longer periods where professional or insurance requirements apply. Access is restricted to those who need it.

7. Your rights

You may have rights to access, correct, restrict or erase information, object to processing, or withdraw consent. You can also complain to the Information Commissioner’s Office at ico.org.uk.

8. Website enquiries

Our first-enquiry forms ask only for your name, a safe email address or telephone number, and, where relevant, your organisation, partnership interest and confirmation of consent to an initial referral enquiry. Please do not include health records or detailed personal circumstances. Where the form shows “Send my enquiry”, enquiries are sent over an encrypted connection and delivered through Google Workspace to our team mailbox. If it shows “Prepare my email”, it opens your email app and you must review and send the message yourself. They are not added to a marketing list.

We use short-lived security records to limit spam and prevent duplicate messages. These contain a request reference, a digest and a daily protected network identifier, not your form answers. Request records expire after seven days and rate-limit records after two days; expired records are removed on the next enquiry. Email records follow our service retention arrangements described above.

9. Optional analytics cookies

Google Analytics loads only if you select “Allow analytics”. It measures visits and whether an enquiry is started or sent, in a dedicated CIC property separate from the commercial FLOAT ONE website. We do not send names, contact details, form answers, health information, enquiry references, URL queries or fragments to analytics. Automatic form and outbound-link measurement is disabled. Advertising features and cross-domain tracking are disabled.

Analytics cookies are limited to this CIC subdomain and expire after 90 days, renewed on use. We remember your cookie choice on this device for six months. You can change it at any time using “Cookie settings”; choosing “No thanks” stops further collection and removes CIC analytics cookies. This does not affect your ability to enquire or receive support. Google processes analytics data on our behalf; see Google’s privacy information.

10. Contact

For privacy questions, rights requests or complaints, email info@floatone.co.uk or write to FLOAT ONE Wellbeing CIC, Unit 22, Roadway 1, Morris Park, 37 Rosyth Road, Glasgow G5 0YD. FLOAT ONE Wellbeing CIC is the data controller and is registered under company number SC881898.