INTRODUCTION

This Privacy Notice explains when and why Suicide&Co ("Suicide&Co", "we", "us") collects personal information, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. It also explains your rights under UK data protection law and how to exercise them. This Notice applies to our services, human resources, and our fundraising and marketing activities.

WHO WE ARE

Suicide&Co is a charity registered in England and Wales (number 1187985) working to provide specialist support for individuals bereaved by suicide. For the activities described in this Notice, Suicide&Co generally acts as a data controller.

Contact Information, Queries and Complaints

If you have questions about this Privacy Notice or how we process your personal data, or if you wish to exercise your rights, please contact us: 

Email: privacy@suicideandco.org

Telephone: 0800 054 8400

Our complaints procedure is outlined in Appendix 4.

Accessibility 

If you require this information in an alternative format, please contact us and we will be happy to assist.

What personal data we collect and why

The data we collect and how we use it depends on your relationship with us. Please see the appendices for details:

Appendix 1 – Services

Appendix 2 – Human Resources (employees, volunteers, contractors)

Appendix 3 – Fundraising and Marketing

Your rights

Under UK data protection law, you have the following rights. Some rights are subject to limitations (for example, safeguarding or legal obligations) and may not always apply. If we cannot fulfil a request, we will explain why.

• Right to be informed – to know how your data is used.

• Right of access – to request a copy of your personal data.

• Right to rectification – to correct inaccurate or incomplete data.

• Right to erasure – to request deletion where legally permitted.

• Right to restrict processing – to limit how we use your data in certain circumstances.

• Right to data portability – to receive certain data in a structured, machine-readable format.

• Right to object – to processing based on legitimate interests or for direct marketing.

• Rights around automated decision-making – we do not make decisions that produce legal or similarly significant effects solely by automated means.

• Right to complain – to complain against any of our activities.

International data transfers

Where personal data is transferred outside the UK, we put in place appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and we perform transfer risk assessments where required.

How long we keep your data

We retain personal data only for as long as necessary to fulfil the purposes set out in this Notice and to meet legal, regulatory, contractual and funder requirements. Specific retention periods are set out in our Retention Schedule and may vary by activity (for example, safeguarding records or research evaluation data). We will provide further information on request.

How We Protect Your Data

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and at rest (where appropriate), data minimisation, secure deletion, staff training, confidentiality agreements, and vendor due diligence. We regularly review and improve these measures.

Changes to this Privacy Notice

We review this Privacy Notice regularly. Significant changes will be communicated directly or via a notice on our website.

Appendix 1 - Services

This appendix covers how Suicide&Co uses personal data to deliver services.

We provide a wide range of services for adults bereaved by suicide such as counselling, emotional and practical support, and digital resources such as our App. Our aim is to support bereaved individuals and open the conversation around suicide-related grief. In doing this, we will collect and process information about you.

What personal data we collect

We only collect the minimum data necessary for each purpose. Depending on the activity, we may collect:

• Identity and contact data – name, date of birth/age, gender, address/postcode, email, phone, preferred contact method.

• Counselling Notes - recorded during the service delivery or shared with us.

• Safeguarding information – disclosures or concerns, risk assessments, chronology/incident logs, safety plans, referrals to statutory agencies.

• Health and special category data (where necessary) – physical or mental health information, disabilities or longterm conditions.

Where we get your data from

We mainly collect all the information directly from you. The channels we use to collect information include:

• From self-referrals for our services made online via our website or over the phone.

• Notes taken by our staff and associate counsellors during conversations with you.

• Information you share with us when signing up for and using the Suicide&Co App.

How we use your data

• To provide counselling and other support services.

• To handle enquiries and provide information about our services.

• To safeguard adults at risk – including assessing risk, recording and responding to concerns, and making referrals to statutory agencies.

Our lawful bases (Article 6 UK GDPR)

• Legitimate Interests (Art 6(1)(f)) – our primary basis for our counselling and support services. Our legitimate interests include delivering effective services, evidencing impact, and managing relationships.

• Vital Interests (Art 6(1)(d)) – for safeguarding, where processing is necessary to protect someone’s life or prevent serious harm.

• Consent (Art 6(1)(a)) – for optional activities such as surveys, newsletters, video testimonials, or where required by law for specific communications.

Special Category Data (Article 9 UK GDPR)

Where we process special category data (e.g., health, ethnicity, beliefs, sexuality) or criminal offence data, we do so only where strictly necessary and with additional safeguards. Our typical conditions include:

• Substantial Public Interest – safeguarding of individuals at risk (Art 9(2)(g) and Data Protection Act 2018, Sch. 1, para 18), or for supporting individuals with a medical condition, counselling or equality and diversity.

• Vital Interests (Art 9(2)(c)) – where the individual is incapable of giving consent and processing is necessary to protect life.

Who we share data with (Services)

• When you apply for our counselling services, we will share your information with one or more of our associate counsellors acting on our behalf as data processors.

• If we have concerns for your safety, we may share your information with other services and organisations in order to protect you from coming to harm.

• Funders and commissioners – typically aggregated or pseudonymised data.

Appendix 2 – Human Resources

This appendix explains how we process personal data for job applicants, employees, workers, contractors, consultants and volunteers or trustees.

Where we get your data from

• Directly from you during recruitment and onboarding, and during your engagement with us.

• From agencies and referees (with your knowledge).

• From preemployment screening such as right-to-work and DBS checks where applicable.

• From internal systems (e.g., HR, payroll, learning and development).

What personal data we collect

• Personal details and contact information.

• Application, CV and interview information; references; employment history and qualifications.

• Contract terms, job role, pay/fees, benefits, working time, leave and absence, performance and supervision records, disciplinary and grievance records, training records.

• Next of kin and emergency contacts.

• Right-to-work and DBS checks where applicable, and other compliance records.

• Special category data (where necessary) – health/occupational health information (e.g., reasonable adjustments), and equality, diversity and inclusion data provided voluntarily.

How we use HR data (purposes and lawful bases)

• To recruit and onboard staff, volunteers and trustees – Contract (Art 6(1)(b)) and Legitimate Interests (Art 6(1)(f)).

• To administer employment/engagement – Contract (Art 6(1)(b)).

• To meet legal obligations – Legal Obligation (Art 6(1)(c)) (e.g., HMRC, right to work, health & safety).

• To manage performance, supervision, learning and development, security and IT systems – Legitimate Interests (Art 6(1)(f)).

• Special category data – Art 9(2)(b) employment and social protection law; Art 9(2)(g) substantial public interest (e.g., equality monitoring under Schedule 1 conditions); occupational health; and where appropriate, explicit consent.

• Criminal offence data – Art 9(2)(g) Substantial Public Interest, handled in line with law and safeguarding or prevention of crime (e.g., DBS).

Who we share data with (HUMAN RESOURCES)

• Payroll, pension, HR and benefits providers (processors).

• Regulators and statutory bodies (e.g., HMRC, Home Office).

• Occupational health and wellbeing providers.

• IT service providers.

• Professional advisers and insurers where necessary.

Appendix 3 – Fundraising and Marketing

This appendix explains how we process personal data for fundraising and marketing, including individual giving, major donors, corporate partnerships, trusts and foundations, events, and supporter communications.

What personal data we collect

• Identity and contact data; communication preferences.

• Donation history, Gift Aid status, event registrations and attendance.

• Engagement information (e.g. email opens/clicks), where permitted.

• For major donor/corporate fundraising: publicly available information (e.g. from Companies House, the Charity Commission, press and your organisation’s website) to understand interests and align opportunities, in line with Legitimate Interests and your rights.

• Payment information processed securely by our payment service providers; we do not store full card details. 

How we use supporter data 

• To process and acknowledge donations and manage Gift Aid.

• To manage events and volunteering opportunities.

• To send you marketing about our work and ways to support us, in line with your preferences and PECR.

• To develop supporter relationships, including segmentation and profiling to tailor messages, under Legitimate Interests; you can object at any time.

• To comply with legal and regulatory requirements and prevent fraud.

Lawful bases (Fundraising & Marketing) 

• Consent (Art 6(1)(a)) – for email marketing to individuals where required by PECR.

• Legitimate Interests (Art 6(1)(f)) – for postal marketing, or soft opt-in related email communications when you have expressed an interest.

• Contract (Art 6(1)(b)) – to administer event bookings or benefits you have asked for.

• Legal Obligation (Art 6(1)(c)) – for Gift Aid and financial recordkeeping.

Who we share data with (Fundraising & Marketing)

• Payment processors and fundraising platforms (as independent controllers).

• Regulators (e.g. HMRC for Gift Aid) and auditors where required by law.

• Event partners and venues where necessary for attendance and safety.

Appendix 4: Complaints Process

If you are unhappy with how we handle your personal data, you have the right to raise a complaint with us. 

You can contact us by:

Email: privacy@suicideandco.org

Telephone: 0800 054 8400

Please provide:

• Your name and contact details

• A clear description of your concern

• Any relevant dates or reference numbers

What happens next?

• We will acknowledge your complaint within 30 days of receiving it.

• We will investigate your concerns.

• We may contact you if we need further information.

• We will respond as soon as possible and without undue delay. 

Our response will explain:

• What we have found

• Whether any action has been taken

• What happens next 

If you are not satisfied 

If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO): 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF 

Telephone: 0303 123 1113‍  ‍

Website: https://ico.org.uk