Last Updated: 12 August 2026
1. Introduction
Welcome to Safe Harbour ("we," "us," or "our"). We provide counselling services, supervision and workplace mental health resources.Safe Harbour is a project operated by Counselling for Social Change, a registered charity in England & Wales (Charity Registration Number: 1160047).We are committed to protecting your privacy and handling your personal information with the highest standards of security, confidentiality, and transparency, in compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), EU GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
2. Confidentiality and the EAP Boundary
Important Note on EAP Confidentiality:
Information disclosed during professional counselling, coaching, or clinical support consultations is subject to strict professional confidentiality rules. Your employer or organisation will never receive personal details or identifiable information regarding your usage of EAP services without your explicit, written consent, except in extraordinary circumstances required by law (e.g., immediate threat to life, serious harm, or a court order).
3. Information We Collect
We collect personal data only when strictly necessary to provide our services, share resources, process inquiries, or fulfil legal obligations.
A. Information You Provide Directly
Enquiry & Service Request Data: Name, email address, phone number, and organisational or employer affiliation provided when contacting us or requesting EAP support.
Lead Generators & Resource Sign-Ups: Name, job title, organisation, and email address collected when downloading resources (e.g., mental health toolkits, whitepapers, or manager guides) or subscribing to our newsletters.
Referral & Clinical Information: Voluntary details provided when booking a consultation or requesting support services.
B. Automatically Collected Data
Technical & System Logs: IP address, browser type, operating system, referring URLs, and access timestamps collected automatically by our hosting server for security, network diagnostics, and system administration.
4. How We Use Your Information and Lawful Bases
We process your personal data under the following lawful bases and for the following purposes:
Purpose / Activity
Personal Data Category
Lawful Basis (UK / EU GDPR)
Delivering EAP Support Services
Contact & Service Request Data
Contract Performance / Explicit Consent
Fulfilling Lead Generator Resources
Name, Job Title, Email, Organisation
Performance of Contract / Legitimate Interests
Email Marketing & Updates
Name, Email Address
Consent (Opt-in) or Legitimate Interests (Charity Soft Opt-in)
Site Security & System Maintenance
Technical Logs, IP Address
Legitimate Interests
Legal & Regulatory Compliance
Relevant Personal Data
Legal Obligation
5. Direct Marketing & Lead Generation
A. How We Use Email Marketing
We use your contact details to send you workplace mental health insights, regulatory updates, practical wellbeing guides, and information about our EAP services.
B. Direct Marketing Compliance
We follow strict marketing standards:
Explicit Lead Opt-In: When downloading a resource or using a lead generator form, subscribing to marketing is separate from receiving the resource. You will only receive ongoing promotional emails if you actively tick an un-ticked opt-in box.
Charity Soft Opt-in: As a charity initiative, where permitted by law under PECR, we may occasionally send relevant organisational updates and service news to individuals who have previously engaged with us, requested resources, or supported our cause, provided we offered a clear option to opt out at the time of collection.
Unsubscribing: Every marketing email includes a clear, single-click "Unsubscribe" link at the bottom. You can also opt out at any time by contacting us directly at office@counsellingforsocialchange.org.uk.
Third-Party Platforms: Marketing emails are processed through secure third-party email service providers bound by Data Processing Agreements. We do not sell, rent, or trade contact lists.
6. Cookies and Tracking Technologies
Current Status: No Non-Essential Cookies
This website currently does not use non-essential tracking cookies, advertising scripts, or third-party performance analytics. We only utilise essential technical mechanisms necessary to display pages correctly and secure our site.
Future Cookie Deployment Notice
If we introduce analytics or functional cookies in the future:
We will implement a compliant Consent Management Platform (CMP).Non-essential cookies will remain disabled by default.
You will be presented with a banner featuring equal options to "Accept All" or "Reject All", alongside granular preference controls.
We will automatically detect and respect Global Privacy Control (GPC) signals transmitted by your browser.
7. AI and Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal or significant effects on you. If AI tools (such as interactive chatbots or automated support tools) are introduced in the future, we will explicitly disclose their presence, ensure human oversight, and obtain any necessary consents prior to processing your data.
8. Data Sharing and International Transfers
We do not sell or monetise personal information. We share data only with trusted third-party service providers (e.g., secure web hosts, clinical practice platforms, email delivery services) operating under strict Data Processing Agreements (DPAs).If data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are active, such as International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs).
9. Data Retention & Security
Retention: We retain personal data only as long as necessary to fulfil the purpose for which it was collected, or to meet legal, accounting, or clinical retention requirements.
Security: We employ technical and organisational measures, including access controls, encryption, and routine system auditing, to safeguard your information against unauthorised access, loss, or misuse.
10. Your Privacy Rights
Under data protection legislation, you have the following rights:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete information.
Right to Erasure ("Right to be Forgotten"): Request deletion of your data under specific circumstances.
Right to Restrict or Object: Limit or object to our processing of your personal data.
Right to Data Portability: Request transfer of your data in a structured, machine-readable format.
Right to Withdraw Consent: Withdraw consent at any time where processing relies on consent.
To exercise any of these rights, please contact our privacy team using the details below.
11. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:Organisation: Safe Harbour (a project of Counselling for Social Change)
Attn: Data Protection Officer / Privacy Lead
Email: office@counsellingforsocialchange.org.uk
Postal Address: Pixel, Causewayhead, Penzance TR18 2SP
If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with your supervisory authority:
UK: Information Commissioner's Office (ICO) – ico.org.uk
EU/EEA: Your national Data Protection Authority (DPA).