The Touchstone privacy policy may change so please remember to check back from time to time, this is version 2, last updated on the 9^th June 2025. Where we have made any changes to this Privacy and Cookies Policy, we will make this clear on our website or contact you about any changes.

• Privacy Policies
• Document Retention and Access to Records Policy
• Confidentiality Policy

2.1 This Policy sets out the personal information that Touchstone may collect as part of our normal business.

2.2 Touchstone is the “data controller” for the purposes of the Data Protection Act 1998. This means that we are responsible for controlling and processing your personal information.

3.1 Information you give us. For example, when you post information on our social media or message boards, make a donation to us, register for an event or otherwise provide us with personal information. When you register, we’ll ask for personal information, like your name, email address, telephone number, date of birth, bank account details for setting up a regular direct debit gift and contact preferences.

3.2 Information we get from your use of our website and services. We collect information about our online content that you use and how you use it, like when you watch a video on YouTube, visit our websites or view and interact with our ads and content. We, like all organisations, are able to confirm what browser you are using, IP address and computer operating systems that are being used and this information may be used to improve the services we offer.

3.3 Information from known third parties. We may also receive information about you from our third-party partners with whom you choose to interact, for example websites such as JustGiving when making a donation. This can include information such as your name, post or email address, phone number, location and credit/debit card details.

3.4 Information available publicly. We may include information found in places such as Companies House, LinkedIn and information that has been published in articles/newspapers.

We will collect, use and store the following kinds of information:

• Names and contract details, where applicable to your social media profile.
• Your date of birth.
• Financial information such as bank details; we won’t store debit or credit card details.
• Information about your computer / mobile device and about your visits to our website.
• Information about the services you access with us.
• Information about any employment or volunteering arrangement.
• Information about your health and wellbeing.
• Any other relevant personal information that you share with us.

4.2 We may collect, use and store the following kinds of sensitive personal information. This could include gender, ethnicity, sexuality, disabilities, religious beliefs, relationship status, residency status, history of mental and physical health, employment history, offending history.

4.3 We will only use this information for the purposes of your enquiry, e.g. training, quality monitoring or evaluating the services we provide. We will not pass on your details without your permission except in exceptional circumstances. Examples of this might include anyone reporting serious self-harm or a threat to others.

4.4 Where you have given us your express consent or otherwise clearly indicated to us, for example agreeing to be a case study, that you are happy for us to share your story, then we may publish it on our website or in other media.

5.1 We gather information such as which pages you visit and when you click on links.

5.2 We use “cookies” to help our site run effectively. ‘Cookie’ is a name for a small file, that is downloaded onto your device when you visit a website. A cookie, by itself, can’t be used to identify you. We use cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you come to our website and allows us to improve the user experience.

5.3 We use the following categories of cookies:

• Strictly necessary cookies are essential for you to move around our website.
• Performance cookies collect anonymous information about how you use our site, like which pages are visited most.
• Functionality cookies collect anonymous information that remembers the choices you make to improve your experience, like your text size or location. They may also be used to provide services you have asked for such as watching a video.

5.4 You can opt out of all our cookies except the strictly necessary ones. But, if you choose to refuse all cookies, our website may not function for you as we would like it to. For detailed technical information on the cookies we use, please check the cookie icon in the bottom left of this page.

6.1 Touchstone uses social media, such as Facebook, , LinkedIn, Instagram. Where members of the public engage with our posts or publish content relevant to our work, we may like the posts, follow them, reply or write to them.

6.2 We conduct research on what people say on public social media platforms to better understand how people feel about our sector and to improve our work.

7.1 In some cases, we will only use your personal information where we have your consent or because we need to use it in order to fulfil a contract with you.

7.2 Other lawful reasons that allow us to process your personal information include ‘legitimate interests’. This means that the reason that we are processing information is because there is a legitimate interest for Touchstone to process your information to help us to achieve our vision of ensuring that everyone experiencing a mental health problem gets both support and respect.

7.3 Whenever we process your personal information under the legitimate interest lawful basis, we make sure that we take into account your rights and interests and will not process your personal information if we feel that there is an imbalance.

7.4 Examples of processing based on legitimate interest include:

• Conducting research
• Providing statistics about mental health
• Taking / using photos at events
• Administering events
• Sending communications
• Marketing materials
• Employee and volunteer recruitment
• The use of CCTV recording equipment
• Promoting Touchstone on social media and other online platforms

8.1 You have the following legal rights in relation to the collection and processing of your personal information:

• Right to be informed – To be told how your personal information will be used.
• Right of access – You can write to us to ask for confirmation of what information we hold on you and to request a copy of that information. Provided we are satisfied that you are entitled to see the information requested and we have successfully confirmed your identity, we will provide you with your personal information subject to any exceptions that apply.
• Right of erasure – At your request we will delete your personal information from our records as far as we don’t have an overriding legitimate reason for holding on to it.
• Right of rectification – If you believe our records of your personal information are inaccurate, you have the right to ask us to update those records.
• Right to restrict processing – You have the right to ask us to restrict the processing of your personal information.
• Right to object – you have the right to object to processing your personal information.

9.1 Touchstone will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Nor do we sell any information about your web browsing activity.

9.2 Touchstone may however share your information with our trusted partners and suppliers who work with us on or on our behalf to deliver our services. Processing this information is always carried out under our instruction. We make sure that they store the data securely, delete it when they no longer need it and never use it for any other purposes.

9.3 We may disclose your personal information if required to do so by legal obligation, for example in response to a request from government bodies or law enforcement.

10.1 Touchstone takes looking after your information very seriously. We’ve implemented appropriate measures to protect the personal information we have under our control, both on and off-line.

10.2 The transmission of information using the internet is not completely secure. Although we do our best to protect your personal information sent to us this way, we cannot guarantee the security of data transmitted.

10.3 Our website may contain links to other sites. While we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, or the privacy practices employed by other sites. Please be aware that advertisers or websites that have links on our site may collect personally identifiable information about you. This privacy statement does not cover the information practices of those websites or advertisers.

To find out more about this policy and how we look after your personal information please email InformationGovernance@TouchstoneSupport.Org.UK