Neuroflect CIC: Privacy Policy

1. Contact details

Neuroflect CIC
Telephone: 07899 798933
Email: hello@neuroflect.co.uk
Website: https://neuroflect.co.uk
Data Protection Officer: Anthony Whyatt
ICO registration: ZC170706

2. What information we collect, use, and why

a. To provide and improve products and services

We may collect or use:

• Names and contact details
• Addresses
• Gender
• Pronoun preferences
• Payment details (including card or bank information for transfers and direct debits)
• Transaction data (payments to and from you, and details of products and services purchased)
• Usage data (how you interact with our website, products, or services)
• Website user information
• Records of meetings and decisions

Special category data:

• Health information (subject to additional protections)

b. Client or customer accounts

We may collect or use:

• Names and contact details
• Addresses
• Purchase or service history
• Account information, including registration details
• Marketing preferences

Special category data:

• Health information

c. Information updates and marketing

We may collect or use:

• Names and contact details
• Addresses
• Marketing preferences
• Website and app user journey information
• IP addresses

We use MailerLite to manage email subscriptions and send newsletters or service updates. When you sign up to our mailing list, your information is stored securely by MailerLite and used only for the purposes you agreed to at the point of sign-up.

Emails sent via MailerLite may include tracking features, such as whether an email has been opened or links clicked. This helps us understand engagement and improve our communications.

You can unsubscribe at any time by using the unsubscribe link included in every email.

d. Recruitment

We may collect or use:

• Contact details (name, address, telephone number, personal email address)
• Date of birth
• National Insurance number
• Copies of passports or other photo ID
• Employment history (applications, references, secondary employment)
• Education history (qualifications)
• Right to work information
• Details of criminal convictions (e.g. DBS, Access NI, or Disclosure Scotland checks)

Special category data:

• Health information

e. Queries, complaints, or claims

We may collect or use:

• Names and contact details
• Addresses
• Account information
• Customer or client records
• Correspondence

f. This applies across all Neuroflect CIC activities, including:

• Online and remote work
• In-person training and events
• Consultancy and site visits
• Co-production and partnership working

3. Lawful bases and your data protection rights

Under UK GDPR, we must have a lawful basis for using your personal information. Depending on the purpose, we rely on one or more of the following:

• Consent
• Contract
• Legal obligation
• Your rights include:
• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to object
• Right to data portability
• Right to withdraw consent (where consent is the lawful basis)

We will respond to requests without undue delay and within one month.

Requests should be made using the contact details above.

4. Our lawful bases by purpose

Providing and improving products and services
We rely on consent where you have actively chosen to engage with us, and contract where processing is necessary to deliver services you have requested.

Client or customer accounts
Processing is based on consent and contract, to manage accounts and deliver agreed services.

Information updates and marketing
Processing is based on consent only. You can withdraw consent at any time.

Recruitment
Processing is based on consent and contract, and where required, legal obligation (for example, right to work checks).

Queries, complaints, or claims
Processing is based on consent and legal obligation, where we are required to retain or share information under law.

5. Where we get personal information from

We collect personal information from the following sources:

• Directly from you, for example when you contact us, complete forms, sign up to newsletters, purchase services, or engage in training or consultancy
• Through your use of our website, including via cookies and analytics tools such as Google Analytics
• From email marketing interactions, such as newsletter sign-ups and engagement data processed via MailerLite

6. How long we keep information

Personal information is retained in line with our data retention schedule, based on legal, regulatory, contractual, and operational requirements.

Further details are available on request.

7. Who we share information with

We may share personal information with:

• Organisations we are legally required to share information with
• Suppliers and service providers, including website hosting, analytics, and email communication providers
• Professional consultants

Third-party service providers (such as Google Analytics and MailerLite) process personal data on our behalf and are required to do so in accordance with data protection law.

8. Cookies, analytics, and website data

Cookies

We use cookies to support the operation and usability of our website.

• A temporary cookie is set after you accept our “Cookie preferences” tool, to record whether your browser accepts cookies. This cookie contains no personal data and is deleted when you close your browser.
• The “Cookie preferences” tool allows you to accept or deny all cookies, or choose from functional, statistics and/or marketing cookies.
• You can also manage or disable cookies through your browser settings. Disabling cookies may affect how the website functions.

Google Analytics

We use Google Analytics to understand how visitors use our website and to help us improve its content and functionality.

Google Analytics collects information such as:

• Pages visited and time spent on pages
• How you arrived at the website (e.g. search engine or referral link)
• General location data (derived from IP address)
• Device, browser, and operating system information

IP addresses are anonymised before storage where possible. Data collected through Google Analytics is processed in a way that does not directly identify you.

Google Analytics uses cookies to collect this information. You can opt out of Google Analytics tracking by adjusting your cookie preferences or browser settings.

Embedded content

Articles on this site may include embedded content (e.g. videos, images, or articles). Embedded content from other websites behaves in the same way as if you had visited the other website directly. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content.

9. How to complain

If you have concerns about how we use your personal data, please contact us first:

We will acknowledge your complaint within 30 days of receipt. Without undue delay, we will take appropriate steps to investigate, keep you informed and inform you of the outcome.

If you remain dissatisfied, you can complain to the Information Commissioner’s Office:

10. Date of Privacy notice

This policy was created on 23/01/2026 and was last updated 29/06/2026