POLICIES, PRIVACY & TERMS

Privacy Policy

Who we are

Restore is the trading name of Rehabilitation Services Trust For Oxfordshire Re-Employment Ltd, an Oxfordshire-based mental health charity that supports people to take control of their recovery, develop skills, and lead meaningful lives.

We provide recovery groups, training and employment coaching, and the Oxfordshire Recovery College, which delivers recovery-focused workshops and courses co-produced with people who have lived experience and/or mental health training.

Restore is registered with the Information Commissioner’s Office under registration number Z4668091.

Restore is the data controller for the personal data described in this privacy policy. This means we are responsible for deciding how and why your personal information is used.

If you have any questions about this policy or how we use your information, you can contact our Data Protection Officer:

Email: DPO@restore.org.uk
Telephone: 01865 455821
Address: Restore, Manzil Way, Oxford, OX4 1YH

Scope of this policy

This privacy policy explains how Restore collects, uses, stores and shares personal information when you:

• use our website;
• complete an online referral form;
• refer yourself or someone else to Restore;
• access our services;
• contact us with an enquiry;
• make a donation or payment;
• attend training, events or courses;
• support Restore as a donor, customer, volunteer, partner or stakeholder.

This policy applies to information collected through our website and online forms, as well as information collected through other contact with Restore.

What information we collect

We may collect and use the following types of personal data:

• Identity data, such as your name, title, date of birth, gender, ethnicity, NHS number and National Insurance number, where relevant.
• Contact data, such as your address, email address and telephone number.
• Referral and service data, such as information provided through online referral forms, self-referrals, professional referrals or enquiries.
• Care and support data, such as information about your mental health, wellbeing, support needs, recovery goals, risks, accessibility needs and notes relating to services we provide.
• Safeguarding and risk information, where this is necessary to protect you or someone else from harm.
• Financial data, such as billing, donation, payment or transaction details where needed.
• Technical data, such as your IP address, browser type, device information, website usage data and security logs.
• Communication data, such as emails, telephone notes, letters, messages or records of contact with us.
• CCTV data, where images are captured in or around our premises.

Some of this information is special category data under UK data protection law. This includes information about health, mental health, ethnicity, disability or other sensitive personal information. We only collect this where it is necessary, proportionate and lawful.

Online referral forms

If you complete an online referral form on our website, we will collect the information you provide so that we can assess the referral, understand support needs, check eligibility for our services, contact you or the person being referred, and decide what support or service may be appropriate.

This may include:

• name and contact details;
• date of birth;
• GP or NHS information where relevant;
• information about mental health, wellbeing and recovery needs;
• information about risk, safeguarding or safety concerns;
• accessibility, communication or support needs;
• details of current support from other services;
• information about the person making the referral;
• any other information you or the referrer choose to provide.

Referral information may be provided directly by the person seeking support, or by someone else making a referral on their behalf, such as a health professional, social care professional, voluntary sector partner, family member, carer or supporter.

Where someone else makes a referral, they should normally have the person’s knowledge and agreement to do so, unless there is another lawful reason for sharing the information, such as safeguarding, serious risk, or another legal or professional responsibility.

What happens after you submit an online referral

When you submit an online referral form, the information is sent securely to Restore. Authorised Restore staff will review the referral and may contact you, the person being referred, or the referrer for further information.

We may use the information to:

• assess whether Restore is the right service;
• understand needs, risks and preferences;
• contact the person being referred;
• manage waiting lists and service access;
• record the referral in our internal systems;
• provide support, advice or signposting;
• meet safeguarding responsibilities;
• monitor service demand, quality and outcomes;
• report to funders or commissioners, usually using anonymised or pseudonymised information.

If Restore is not the right service, we may signpost to another organisation or, where appropriate and lawful, share relevant information with another service better placed to help.

Why we use your information

We use personal data to:

• provide advice, guidance, support and services;
• assess referrals and match people with appropriate support;
• communicate with you in your preferred way;
• keep records of our relationship with you;
• support your recovery goals;
• help people move towards volunteering, employment, education or other opportunities;
• manage safeguarding, risk and wellbeing concerns;
• monitor, evaluate and improve our services;
• meet contractual, legal, safeguarding and regulatory responsibilities;
• process donations, payments and other transactions;
• respond to enquiries, complaints or requests;
• manage website usage, security and service performance;
• report to funders, commissioners, auditors and regulators where required.

We may also use information to understand and improve our services overall, but only in ways that are proportionate and lawful.

Lawful basis for using personal data

We process personal data under UK GDPR only where we have a lawful basis to do so.

Depending on the activity, we may rely on one or more of the following lawful bases:

• Consent, where you have given us clear permission, for example to receive marketing or to share your story publicly.
• Contract, where processing is needed to provide a service you have requested or to take steps before providing that service.
• Legal obligation, where we must comply with a legal requirement.
• Legitimate interests, where processing is necessary for Restore’s legitimate organisational purposes and your rights and freedoms do not override those interests.
• Vital interests, where processing is necessary to protect someone’s life or safety.

For online referrals, service enquiries and support work, we will usually rely on legitimate interests, contract, legal obligation or vital interests depending on the circumstances.

Special category data

Some of the information we collect, particularly through referral forms and service delivery, may include special category data. This may include information about health, mental health, disability, ethnicity or other sensitive information.

Where we process special category data, we must have both:

• a lawful basis under Article 6 of UK GDPR; and
• a special category condition under Article 9 of UK GDPR.

Depending on the circumstances, we may rely on conditions such as:

• processing necessary for the provision of health or social care services;
• processing necessary for safeguarding or substantial public interest reasons;
• explicit consent, where this is appropriate;
• processing necessary to protect vital interests where someone is unable to give consent.

We only collect and use special category data where it is necessary, proportionate and lawful.

Confidentiality, safeguarding and serious risk

We treat referral and service information as confidential. Access to personal information is restricted to staff, volunteers, contractors or partners who need the information to carry out their role.

However, confidentiality is not absolute. We may need to share information without consent where this is necessary to:

• protect you or someone else from serious harm;
• respond to a safeguarding concern;
• contact emergency services;
• comply with a legal obligation;
• prevent or detect crime;
• protect someone’s vital interests;
• respond to a serious risk to health, safety or wellbeing.

Where possible and appropriate, we will try to discuss this with you before sharing information, but this may not always be possible in an emergency or safeguarding situation.

Information sharing

We only share personal data where there is a lawful and necessary reason to do so.

In the normal course of our work, Oxford Health NHS Foundation Trust usually receives anonymised or pseudonymised information only. Where identifiable personal data must be shared, this will only happen where it is necessary, proportionate and lawful.

Depending on the circumstances, we may share relevant information with:

• NHS services, GPs or other health professionals;
• social care professionals;
• safeguarding bodies;
• emergency services;
• partner organisations involved in providing support;
• the person or organisation that made a referral, where appropriate;
• funders, commissioners, auditors and regulators, where required;
• IT, website, hosting, database and administration providers acting on our behalf as data processors;
• professional advisers such as insurers, accountants or legal advisers;
• organisations involved in complaints, investigations, legal claims or regulatory matters.

Where we use third-party providers to support our website, online forms, IT systems or administration, they may process personal data on our behalf. We require them to handle information securely, lawfully and only in line with our instructions.

We do not sell personal information.

Information from clients and people using our services

Using personal data helps us make informed decisions and provide the right support. We may use the information you share with us to:

• answer questions;
• provide advice and guidance;
• offer suitable services;
• support your recovery goals;
• help you access recovery groups, courses, coaching or other opportunities;
• help you move towards volunteering, employment or education.

If you choose to share your story or experiences with us, we will only publish or share that information publicly with your explicit and informed consent. You can withdraw that consent at any time.

Information from supporters, donors, customers and other website users

If you contact us as a supporter, donor, customer, partner, professional, commissioner or other website user, we may collect basic information such as your name, contact details, organisation, role and the reason for your enquiry.

We use this information to:

• respond to you;
• process donations, bookings, payments or purchases;
• manage our relationship with you;
• maintain accurate records;
• improve our services and communications;
• meet legal, financial or reporting requirements.

Communications and marketing

We use an opt-in approach for marketing communications.

We will only send marketing emails, calls or postal communications where you have clearly said that you want to receive them, or where the law otherwise allows us to do so.

You can withdraw your consent or change your communication preferences at any time by contacting us or using the unsubscribe option where available.

We will not use referral or service information for marketing purposes unless you have clearly agreed to this.

Website use, cookies and tracking

Our website may use cookies and similar technologies to help the site function properly, improve performance and understand how the website is used.

Some cookies are necessary for the website to work. Others, such as analytics or performance cookies, help us understand how people use the website and improve user experience.

Where required, we will ask for your consent before placing non-essential cookies. You can usually control cookies through your browser settings and, where available, through our cookie consent tool.

For more information about the cookies we use and how to manage your choices, please see our Cookie Policy.

Security of online forms and personal information

We use appropriate technical and organisational measures to protect personal data. These may include:

• secure online forms;
• encryption where appropriate;
• access controls;
• password protection;
• staff training;
• secure storage systems;
• monitoring of systems;
• restricted access to information;
• data protection policies and procedures.

Access to personal information is limited to staff, volunteers, contractors and partners who need it to do their work.

No method of online transmission or electronic storage is completely risk-free, but we take reasonable steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

Retention

We keep personal data only for as long as is necessary for the purpose for which it was collected, including any legal, contractual, safeguarding, audit or reporting requirements.

Different types of records are kept for different periods. For example, referral, service-user and safeguarding records may need to be kept for longer than general website enquiries or marketing preferences.

We maintain records management and retention arrangements which set out how long different categories of information are kept.

When information is no longer needed, we will securely delete, destroy or anonymise it.

Your rights

You have rights under data protection law, including the right to:

• be informed about how your data is used;
• access your personal data;
• have inaccurate data corrected;
• have your data erased in some circumstances;
• restrict how we use your data in some circumstances;
• object to certain types of processing;
• withdraw consent where consent is our lawful basis;
• receive a copy of certain data in a portable format where applicable.

These rights do not apply in every situation. For example, we may need to keep or use certain information to meet legal, safeguarding, contractual or legitimate organisational responsibilities.

To exercise your rights, please contact our Data Protection Officer at:

DPO@restore.org.uk

Complaints

If you have concerns about how we use your personal data, please contact us first so we can try to resolve the issue.

You can contact our Data Protection Officer at:

DPO@restore.org.uk
01865 455821

You also have the right to complain to the Information Commissioner’s Office, which is the UK supervisory authority for data protection matters.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in the law, our services, our website, our online forms, or the way we use personal data.

The latest version will always be available on our website.

Contact us

Restore
Manzil Way
Oxford
OX4 1YH

Telephone: 01865 455821
Email: DPO@restore.org.uk

Reviewed: June 2026