Touchstone is committed to protecting and respecting your privacy and keeping your data secure.

We require consent to process your data.

Purpose of processing your data

We will only process your personal data to:

  • Provide you with the service that you have requested from us.
  • Provide feedback to our commissioners and funders. This is contractual obligation which is done anonymously using overall statistics.

How we get your data

By providing us with your data and agreeing to this privacy notice, you are giving us your consent to process your data. If you do not consent we will not be able to provide you with the service you have requested.

We may obtain your personal data from a third-party referrer. This may include your name, address, contact information, date of birth, gender, ethnicity, sexuality, disabilities, relationship status, residency status, diagnoses, history of mental and physical health, employment history, offending history, GP’s details and NHS number. We will always check directly with you that the information provided by a third-party referrer is correct.

We will never obtain personal data concerning you from publicly accessible sources.

Sharing your data

In general, access to your personal data will be restricted to those who have a need to access it in order to carry out their duties within Touchstone.

We may share your data with:

  • Touchstone commissioners and funders.
  • Touchstone partner organisations. If the service you are accessing is run in partnership with another organisation, we will share your personal data on a need-to-know basis only
  • Third-party organisations. We will always gain your consent beforehand.

If we have concerns for your safety or the safety of others we withhold the right to pass these concerns and any related data to other third parties – for example, a mental health crisis team or if necessary the police. We will follow our Safeguarding Policy (available on request) in relation to any concerns surrounding child safety or adults at risks.

Our Privacy Policy is here.

Your rights

You have the right to access from Touchstone any personal data that we hold about you. Any request should be made in writing and we will provide the requested information within one month of receipt.

You have the right to withdraw your consent to Touchstone holding any personal data concerning you.

  • A withdrawal of consent should be made in writing and we will respond within one month of receipt.
  • We will remove any personal data concerning you unless we have a legal duty to retain it. Legal data retention periods are specified in our Record Management Policy (available on request)

You have the right to lodge a complaint if you feel that we are not treating or using your personal data in the right way. You can make a complaint via:

  • The Touchstone Complaints Procedure (available upon request)
  • Or if you feel it necessary, via the Information Commissioners Office

Further details are set out in our Privacy and Cookies Policy (available on request).


If you have any questions about this you can contact our Data Controller: