Privacy Notice
The Grey Matters Centre Privacy Notice
Who we are and what this notice covers
This notice explains how Grey Matters Centre Limited collects, uses and protects your personal information. It covers Grey Matters Centre and the Integration Centre, our website, our social media and every way you contact us: online, by phone, by email or in person.
Throughout, “we”, “us” and “our” mean Grey Matters Centre Limited. We are the “controller” of the information described here, which means we decide how and why it is used. Louise Fenton is our Data Protection Lead and handles all data protection matters on behalf of the company.
Your therapy records
Each therapist at Grey Matters Centre works independently in their own private practice. Your therapist is the controller of your clinical notes, assessment forms and session records. They will give you their own privacy notice at your first session, explaining how they hold your records, who they share them with (for example their clinical supervisor) and how long they keep them. Questions about those records should go to your therapist first.
For the privacy notice that covers your therapy, please ask your therapist for a copy of their own privacy policy.
How to contact us
| info@greymatterscentre.co.uk (subject line: Data protection) | |
| Telephone | 07907 613600 |
| Post | Data Protection Lead, Grey Matters Centre, 308A Ashby Road, Scunthorpe, North Lincolnshire DN16 2RS |
| Office hours | Monday to Friday, 9am to 6pm |
Company number: 11030314 · Registered office: 308 Ashby Road, Scunthorpe DN16 2RS · ICO registration number: ZB643643
Information we collect
We only collect what we need to help you, run our centres and meet the law. Most of it comes directly from you when you enquire, book, hire a room or venue, or join our mailing list.
- Your name, contact details and preferred way of being contacted
- What you’ve asked us about and any notes of our conversations
- Any health or personal details you choose to share so we can match you with a suitable therapist
- Booking, room hire and venue hire details, including any access needs
- Invoices and payment records (we don’t store card details; payments are handled by our payment provider)
- Checks on people and groups hiring the Integration Centre
- Your marketing preferences and whether you open our emails
- Website and cookie data, where you’ve agreed to it
Occasionally we receive your details from someone else, such as a GP, a referring organisation or a group hiring the Integration Centre. We’ll only use them for the reason they were passed to us.
How we use it and our lawful basis
UK data protection law requires a lawful reason (a “lawful basis”) for each use of your information. Ours are set out below.
| What we use | Why | Lawful basis |
|---|---|---|
| Name, contact details and enquiry | To reply and help you find the right therapist or space | Legitimate interests, or steps you’ve asked us to take before a booking |
| Health or personal details you share when enquiring | To match you safely with a suitable therapist | Your explicit consent, which you can withdraw at any time |
| Booking, room hire and venue hire records | To manage appointments, room use and group bookings | Contract |
| Invoices, payments and business records | To keep accounts and meet tax rules | Legal obligation |
| Checks on Integration Centre hirers | To keep the venue, its users and our community safe | Legitimate interests |
| Mailing list details and preferences | To send news, events and offers | Consent, or the soft opt-in for existing clients and hirers |
| Website, cookie and email engagement data | To understand which pages and messages are useful | Consent |
| Information about a serious risk of harm | To protect you or someone else | Vital interests, legal obligation or safeguarding |
We rely on legitimate interests only where you would reasonably expect it and the impact on you is minimal. You can object at any time. We never use your information for automated decisions that affect you.
Marketing emails
Messages you need, such as booking confirmations, reminders and invoices, are part of the service you’ve asked for. They don’t require your marketing consent.
We only send news, events and offers if you’ve opted in, or if you’re an existing client or hirer, the message is about similar services and you were given a clear chance to opt out when we collected your details (the “soft opt-in”). We never send marketing to anyone whose details were passed to us by someone else, bought or found online.
Every marketing email has an unsubscribe link, which takes effect straight away. You can also email or call us and we’ll update our records within 30 days at the latest.
Who we share it with
We never sell your information. We share it only:
- with your chosen therapist, so they can arrange your first session
- with trusted suppliers who help us run the centres, such as our booking, email, website, accounting and payment systems, under written agreements that require them to protect it
- where the law requires us to, or where someone is at serious risk of harm
Some of our suppliers store information outside the UK. Where they do, we make sure it is protected to UK standards, for example through a UK adequacy decision or approved contract terms.
How long we keep it
We keep your information no longer than necessary and only up to 7 years. The only exception is where the law requires us to hold it for longer, for example during a legal claim or a tax enquiry.
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to a booking | 12 months from our last contact with you |
| Health or personal details you share when enquiring | Until passed to your chosen therapist, or 6 months if you don’t book |
| Mailing list details | Until you unsubscribe, reviewed after 2 years without any engagement |
| A record that you’ve unsubscribed (email address only) | Up to 7 years, so we don’t contact you by mistake |
| Bookings, room and venue hire agreements, invoices | 6 years after the end of the financial year they relate to |
| Checks on Integration Centre hirers | For the hire, then up to 6 years after it ends; DBS certificate copies no more than 6 months |
| Data protection complaints | 3 years after the complaint is closed |
When a period ends we securely delete or anonymise the information.
Our website and cookies
Our website uses essential cookies to work properly. We only use other cookies, such as analytics, if you agree through our cookie banner. Our Cookie Policy lists the cookies we use and how to manage them in your browser.
Our website may link to other sites, including our therapists’ own pages. We aren’t responsible for how those sites handle your information, so please read their privacy notices.
If you message us on Facebook or another social platform, that platform also processes your information under its own privacy policy. For anything personal, please email or call us instead.
How we keep it secure
Only people who need your information can access it. Our systems are password-protected and any paper records are kept in locked storage. If something ever goes wrong that puts your information at risk, we’ll act quickly, tell you where the law requires it and report it to the ICO.
Your rights
You have the right to:
- See the information we hold about you (a subject access request)
- Correct anything that’s wrong or incomplete
- Delete your information where we no longer need it or have no lawful reason to keep it
- Restrict how we use it while a concern is looked into
- Object to our use of it for legitimate interests or for any marketing
- Withdraw consent at any time, without affecting anything we did before
- Move information you gave us to another provider, where it’s held electronically
- Complain to us and to the Information Commissioner’s Office (ICO)
There’s no charge for using these rights. We’ll reply within one month, or up to two further months for complex requests, in which case we’ll tell you why within the first month. We may ask you to confirm your identity first.
Concerns and complaints
If you’re unhappy with how we’ve handled your information or contacted you, please tell us by email, phone, post or in person. Our Data Protection and Contact Complaints Procedure explains what happens next. We’ll give you a full answer within 30 days.
If you’re still unhappy, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We review this notice every year and whenever the law or our services change. Last updated: November 2026.