Data Protection Privacy Notice
In providing you with our website, there is data we must collect as is necessary for the running of the website and data there is optional but helpful. This privacy notice is in place to provide you with information on what, why, how, and for how long data is processed.
We manage the data you provide in accordance with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
The Data Controller (the organisation that determines how your data is processed) is Catch22 Charity Limited. Contact us if you have a query about how your data is managed.
More information can be found in our privacy notice.
What information do we collect and why do we need it?
The information we collect is collected from either your computer or from yourself. This information can be split into three categories; analytics, cookies, and Feedback/Complaints.
Analytics
This website is hosted by Squarespace. Squarespace collects personal data when you visit this website, including:
Information about your browser, network, and device
Web pages you visited before coming to this website
Web pages you view while on this website
Your IP address
Squarespace needs the data to run this website and to protect and improve its platform and services. Squarespace analyses the data in an anonymised form.
This information may also include details about your use of the website including:
Clicks
Internal Links
Pages Visited
Scrolling
Searches
Timestamps
This information is shared with Squarespace as our website analytics provider to learn about site traffic and activity.
Cookies
This website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.
These necessary and required cookies are always used, which allow Squarespace, our hosting platform, to securely serve this website to you.
These analytics and performance cookies are used on this website, as described below, only when you accept the cookies through our cookie banner. This website uses analytics and performance cookies to view site traffic, activity, and other data. You can change our preferences at any time by scrolling to the bottom of any page and selecting from the ‘Cookie preferences’ banner on your browser.
Complaints/Feedback and Enquiries
When we receive a complaint from a person, the complaint is logged. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for six years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘data minimisation’ principle.
Similarly, where enquiries/feedback are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.
Catch22 undertakes the processing of your Complaints/feedback and enquiries data as part of its legitimate interests.
What law applies and sets out the legal basis for us to collect and hold your information?
The three main pieces of law that apply are:
The UK General Data Protection Regulation (UK GDPR)
The Data Protection Act 2018 (DPA 2018)
The Privacy and Electronic Communications (EC Directive) Regulations 2003
We must have a lawful basis for processing your personal data. These are:
Legitimate Interests (UK GDPR Article 6(1)(f)) – for necessary cookies and the handling of complaints and enquiries.
Consent (UK GDPR Article 6(1)(a)) – for non-essential cookies.
Legal Obligation (UK GDPR Article 6(1)(c)) – where we are required to process data to comply with legal duties, including in relation to complaints.
Where we process special category data (such as data relating to health, ethnicity, or other sensitive matters), we rely on:
Substantial Public Interest (UK GDPR Article 9(2)(g)) – particularly in the context of complaints and safeguarding concerns.
Under the Data Protection Act 2018, this is supported by the following conditions in Schedule 1, Part 2:
Paragraph 10 – Preventing or detecting unlawful acts: where complaints involve allegations of misconduct, fraud, or criminal behaviour.
Paragraph 12 – Regulatory requirements relating to unlawful acts and dishonesty: where we are required to investigate or report under legal or regulatory frameworks.
Paragraph 18 – Safeguarding of children and individuals at risk: where complaints or enquiries relate to the protection of vulnerable individuals.
We maintain an appropriate policy document, as required under Schedule 1, Part 4 of the DPA 2018, which outlines our procedures for securing and retaining this data.
Where do we get your data from and who is it shared with?
Cookies and analytics are gathered from your device as you interact with our website. Complaint and related information is gathered from yourself and involved stakeholders.
Analytics and cookies are shared with Squarespace. Complaint information is shared with only the relevant stakeholders and where required under legal or contractual requirements, third parties such as police, regulators, or contract commissioners.
What rights do you have over the information that we hold on your behalf?
You have a number rights over your data that we are required by law to uphold. You have the following rights:
The right to be informed - How we will use your information
The right of access – How to access information we hold about you
The right to rectification – Request that information that is held about you and is inaccurate or incomplete be rectified
The right to erasure – Requests that under special circumstance information held on you may be removed or deleted
The right to restrict processing – Block or suppress processing of information about you
The right to data portability - Obtain and re-use information held about you for your own purposes across different services
The right to object - Object to processing of information about you
The right to lodge a complaint with the Information Commissioners Office (ICO)
If you would like to request a copy of the information we hold about you, please contact DPO@catch-22.org.uk.
If you think the information we hold on you is wrong, please contact DPO@catch-22.org.uk.
If you have any questions about this privacy policy or of our treatment of your personal data, email dpo@catch-22.org.uk or write to:
Data Protection Officer
Catch22
27 Pear Tree Street
London
EC1V 3AG
ICO Registration Number: Z1473239
If you feel that we have not processed your data correctly and in accordance with GDPR and the Data Protection Act 2018, you have the right to make a complaint to the
Information Commissioners Office (body that regulates Data Protection). Please visit
https://ico.org.uk/ or call 0303 123 1113 in order to lodge a complaint with the regulator.