Privacy Policy
The Essex Hub CIC ("we", "us", "our")
Registered office: New House, Crown Way, Southminster, Essex CM0 7AP
Company number: 16766843
Contact: hello@theessexhub.co.uk
Last updated: June 2026
Version: 1.0
This policy explains how we collect, use and protect personal data when you contact us, when we provide commissioned services, and when you use this website. We handle personal data in line with the UK GDPR and the Data Protection Act 2018.
1. Who we are and what we do
The Essex Hub CIC is a community interest company operating as a backbone commissioning organisation across Mid Essex and beyond. We commission structured early intervention for children, young people and adults, and hold the safeguarding, referral pathways and outcomes measurement centrally on behalf of commissioners.
For all data protection enquiries, contact: Lisa Fawcett, Director and data protection lead hello@theessexhub.co.uk when you use this website. We handle personal data in line with the UK GDPR and the Data Protection Act 2018.
2. What personal data we collect
We collect different categories of personal data depending on how you interact with us.
General enquiries. Name, email address, phone number, organisation (where relevant), and the content of your message.
Commissioner and referrer contact. Name, role, organisation, work email, work phone, and information related to the commissioning or referral conversation.
Commissioned provision (participants). Where we receive a referral from a commissioner or professional, we may process: participant name, date of birth, contact details, school or setting, parent or carer contact details (for under-18s), the reasons for referral, relevant medical or SEND information, risk-relevant information, safeguarding notes, attendance records, and outcomes data (SWEMWBS scores and distance-travelled data).
Special category data. Where the referral involves health data, mental health information, SEND status, or other special category data under UK GDPR Article 9, we process this only with appropriate safeguards and a valid Article 9 condition (see section 4).
Website and cookies. Standard website data including IP address, device type and browser. See our Cookie Policy for detail.
3. Where the data comes from
Most data we hold comes directly from the person, their parent or carer, or the professional making a referral. Some data may be supplied by a commissioning body (a school, local authority or ICB) under a data sharing arrangement.
4. Lawful basis for processing
We rely on the following lawful bases under UK GDPR Article 6:
Consent (Art. 6(1)(a)) for general enquiries, participation in commissioned provision where consent is the appropriate basis, and marketing communications.
Contract (Art. 6(1)(b)) for delivering commissioned provision to the commissioner.
Legal obligation (Art. 6(1)(c)) for safeguarding disclosures and statutory reporting.
Public task (Art. 6(1)(e)) where we are processing in connection with provision commissioned by a public authority.
Legitimate interests (Art. 6(1)(f)) for operating, governing and evidencing the work of the CIC, where this is not overridden by individual rights.
For special category data under Article 9, we rely on:
Explicit consent (Art. 9(2)(a)) where appropriate, or Substantial public interest (Art. 9(2)(g)), supported by conditions in Schedule 1 of the Data Protection Act 2018 including safeguarding of children and individuals at risk. A Data Protection Impact Assessment is in place for our referral and commissioning processes and is reviewed annually.
5. How we use personal data
We use personal data to:
Respond to enquiries and arrange commissioning conversations
Manage referrals into commissioned provision
Match participants to the right delivery partner and pathway
Deliver and oversee commissioned provision
Discharge safeguarding duties
Measure outcomes using validated tools (SWEMWBS, SDQ where appropriate) and report to commissioners
Meet legal, regulatory and governance obligations
Improve our services
6. Who we share data with
We share personal data only where there is a lawful basis to do so.
Recipients may include:
Commissioned delivery partners (Reel Impact Angling Ltd, Equimindful, Aspire Body Transformations, and other vetted partners in our supply chain), under written service agreements that include data protection terms
Commissioners (schools, MATs, local authorities, ICBs, statutory partners) for outcomes reporting and safeguarding-relevant information
Statutory partners (Children's Services, LADO, the police) where we have a safeguarding or legal duty to disclose
Funders in the form of anonymised or aggregated outcomes reporting
Service providers who help us operate, including: - Wix (website host) - Airtable (referral and operations management) - QuickBooks (invoicing and accounts) - Google Workspace (email and document storage) -
SWEMWBS via the University of Warwick platform (outcomes measurement) - Youthinmind (SDQ administration, where applicable) - Beacon CRM (relationship management)
All third-party processors are bound by data processing terms consistent with UK GDPR requirements. We do not sell personal data. We do not share personal data for marketing.
7. International transfers
Some of our processors store data outside the UK, including in the European Economic Area and the United States. Where data is transferred outside the UK, transfers rely on UK adequacy decisions, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, with appropriate supplementary measures.uthority or ICB) under a data sharing arrangement.
8. How long we keep data
We retain personal data only as long as necessary.
Indicative retention periods:
General website enquiries (no follow-up commissioning) - 12 months
Commissioner correspondence - 6 years after end of commissioning relationship (HMRC + contractual)
Active commissioned provision records - Duration of the provision plus 7 years for children's records (statutory safeguarding standard), or 6 years for adults
Safeguarding incident records - In line with statutory retention guidance, typically 25 years for child records
Outcomes data (SWEMWBS, SDQ) - Anonymised after 3 years; identifiable data retained per commissioned provision retention above
Financial records - 6 years (HMRC requirement)
Detailed retention is set out in our internal Retention Schedule, available on request.
9. Your rights
Under UK GDPR you have the right to:
Be informed about how we use your data (this policy)
Access the personal data we hold about you (Subject Access Request)
Rectify inaccurate or incomplete data
Erasure ("right to be forgotten") in certain circumstances
Restrict processing in certain circumstances
Object to processing based on legitimate interests
Data portability for data you've provided
Withdraw consent at any time where consent is the lawful basis
Not be subject to solely automated decision-making (we do not carry out automated decision-making or profiling)
To exercise any of these rights, email hello@theessexhub.co.uk. We will respond within one calendar month, in line with UK GDPR Article 12(3). For complex requests we may extend this by up to two further months and will tell you if so.
10. Complaints
If you're unhappy with how we've handled your data, please contact us first at hello@theessexhub.co.uk so we can try to resolve it.
You also have the right to complain to the Information Commissioner's Office: Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk
11. Children's data
Where a participant is under 18, we process their data only with the consent of a person with parental responsibility, or another lawful basis (typically substantial public interest for safeguarding purposes). We hold a Safeguarding Policy that governs how we manage children's data, available on request and referenced in every commissioning agreement.
12. Cookies and website data
See our [Cookie Policy](https://www.theessexhub.co.uk/privacy-policy) for information about cookies and analytics used on this website.
13. Changes to this policy
We review this policy at least annually and update it when our practices or the legal framework change. The "Last updated" date at the top of this policy reflects the current version.