About this procedure
If you’re unhappy with how we’ve handled your personal information or how we’ve contacted you, we want to hear about it and put it right. We believe you should feel safe, respected and listened to in every contact you have with us, including the emails we send.
This procedure covers Grey Matters Centre and the Integration Centre. Throughout, “we”, “us” and “our” mean Grey Matters Centre Limited, which is responsible for (the “controller” of) the personal information described here.
What this procedure covers
- How we collect, store, use and share your personal information
- Emails, texts, calls and other messages we send you
- Our mailing list, newsletters and offers
- Enquiries, bookings and venue hire for both centres
- Requests to see, correct or delete your information
What it doesn’t cover
Each therapist at Grey Matters Centre works independently in their own private practice. Your therapist is responsible for your clinical notes and session records. Any concern about those records, or about your therapy itself, should go to your therapist first. If you’re not sure who to contact, write to us and we’ll point you in the right direction.
How to reach us
| info@greymatterscentre.co.uk (subject line: Data complaint) | |
| Telephone | 07907 613600 |
| Post | Data Complaints, Grey Matters Centre, 308A Ashby Road, Scunthorpe, North Lincolnshire DN16 2RS |
| Office hours | Monday to Friday, 9am to 6pm |
What we hold and why
We only hold information we need to support you, run our centres and meet the law. Under UK data protection law we must have a lawful reason (a “lawful basis”) for each use. Ours are set out below.
| What we hold | Why we hold it | Our lawful basis |
| Your name, contact details and what you’ve asked us about | To reply to your enquiry and help you find the right therapist or space | Legitimate interests, or steps you’ve asked us to take before a booking |
| Any health or personal details you choose to share when you enquire | To match you safely with a suitable therapist | Your explicit consent, which you can withdraw at any time |
| Booking, room hire and venue hire records | To manage appointments, room use and group bookings | Contract |
| Invoices, payments and business records | To keep accounts and meet tax rules | Legal obligation |
| Checks on people and groups hiring the Integration Centre | To keep the venue, its users and our community safe | Legitimate interests |
| Mailing list details and your contact preferences | To send news, events and offers you’re likely to want | Your consent, or legitimate interests for existing clients (see the next section) |
| Website, cookie and email engagement data | To understand which pages and messages are useful | Your consent, given through our cookie banner or sign-up form |
| Information about a serious risk of harm | To protect you or someone else | Vital interests, legal obligation or safeguarding |
What legitimate interests means for you
We rely on legitimate interests only where you would reasonably expect us to use your information in that way. We check that our interest is balanced against your rights and that the impact on you is minimal. You can object at any time and we’ll stop unless we have a compelling reason to continue, such as a legal claim. We’ll always stop for marketing.
Who we share it with
We never sell your information. We share it only with your chosen therapist, with trusted suppliers who help us run the centres (such as our booking, email and accounting systems) under written agreements, or where the law requires us to.
How long we keep your information
We keep your information no longer than necessary and only up to 7 years. The only exception is where the law requires us to hold it for longer, for example during a legal claim or a tax enquiry.
| Information | How long we keep it |
| Enquiries that don’t lead to a booking | 12 months from our last contact with you |
| Health or personal details you share when enquiring | Until passed to your chosen therapist, or 6 months if you don’t book |
| Mailing list details | Until you unsubscribe, reviewed after 2 years without any engagement |
| A record that you’ve unsubscribed (email address only) | Up to 7 years, so we don’t contact you by mistake |
| Bookings, room and venue hire agreements, invoices | 6 years after the end of the financial year they relate to |
| Checks on people and groups hiring the Integration Centre | For the hire, then up to 6 years after it ends; we never keep copies of DBS certificates for more than 6 months |
| Data protection complaints | 3 years after the complaint is closed |
When a period ends we securely delete or anonymise the information.
How and why we contact you
We contact you in two ways: messages you need about something you’ve asked us for, and optional news and offers you can stop at any time.
Messages you need
Replies to enquiries, booking confirmations, reminders, invoices and important changes to our services or terms. We send these because they’re part of the service you’ve asked for (contract or legitimate interests). They don’t need your marketing consent and they’ll never be used to sell to you.
News, events and offers
We’ll only send these if one of the following applies:
- You’ve said yes. You opted in, for example by ticking a box on our website or a booking form. This is consent.
- You’re an existing client or hirer. You’ve booked with us or hired a room or venue, we’re telling you about similar services and you were given a clear chance to opt out when we collected your details. This is known as the “soft opt-in” and relies on our legitimate interests.
We won’t send marketing to anyone who has simply been mentioned to us by someone else, or whose details we’ve bought or found online.
Stopping or changing messages
Every marketing email includes an unsubscribe link. Using it takes effect straight away. You can also email or call us and we’ll update our records within 30 days at the latest. Stopping marketing won’t affect messages you need about bookings you’ve already made.
Your rights
You have the right to:
- See the information we hold about you (a subject access request)
- Correct anything that’s wrong or incomplete
- Delete your information where we no longer need it or have no lawful reason to keep it
- Restrict how we use it while a concern is looked into
- Object to our use of it for legitimate interests or for any marketing
- Withdraw consent at any time, without affecting anything we did before
- Move information you gave us to another provider, where it’s held electronically
- Complain to us and to the Information Commissioner’s Office (ICO)
There’s no charge for using these rights. We’ll reply to rights requests within one month. If a request is complex or you’ve made several, the law allows us up to two further months. We’ll tell you within the first month if we need this and why. We may ask you to confirm your identity before we act so that we don’t share your information with the wrong person.
How to make a complaint
You can complain in whatever way suits you: by email, by phone, by post or in person at the centre. You don’t need to use a form or particular wording. Whoever you speak to will pass your complaint to our Data Protection Lead, who handles it on behalf of Grey Matters Centre Limited.
It helps if you tell us
- Your name and how you’d like us to reply
- What happened, when and which centre it relates to
- Copies or screenshots of any emails or messages involved
- What you’d like us to do to put things right
If something’s missing, we’ll ask rather than delay.
Complaining on someone else’s behalf
A relative, friend, carer or advocate can complain for you. Before we look into it, we’ll need to confirm they have your permission, for example a signed note from you or a legal document such as a power of attorney. This protects your privacy.
Young people
If you’re under 18 you can complain yourself. We’ll reply in clear, simple language. A parent or carer can complain for you where you’re not able to, or you’d like them to.
What happens next
We’ll acknowledge your complaint within 30 days and aim to give you a full answer within 30 days of receiving it.
- We acknowledge it. We’ll confirm we’ve received your complaint, who is handling it and when to expect a reply. We aim to do this within a few working days and always within 30 days. If we can resolve it fully within that time, our full reply will serve as the acknowledgement.
- We look into it. We’ll check our records and systems and speak to anyone involved. If you’ve asked us to stop marketing, we’ll do that straight away while we investigate.
- We give you our answer. Within 30 days of receiving your complaint we’ll write to you explaining what we found, whether we got something wrong and what we’ll do to put it right. Our answer will also tell you how to contact the Information Commissioner’s Office if you’re not satisfied.
- If we need longer. Some complaints take more time, for example where a supplier holds the information. We’ll tell you why before the 30 days are up, give you a new date and keep you updated at least every 30 days.
We keep a record of every data protection complaint and what we did about it. We use these to improve how we look after people’s information.
If you’re still unhappy
You can complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. You’re free to do this at any time, although the ICO will usually ask whether you’ve given us the chance to put things right first.
| Online | ico.org.uk/make-a-complaint |
| Telephone | 0303 123 1113 |
| Post | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF |
Reviewing this procedure
We review this procedure every year and whenever the law or our services change. Next review: 22 October 2027.