GDPR Policy

Last updated: October 2025

This GDPR Policy applies to Imagine Inclusion CIC and Imagine Arts & Minds CIC, which jointly operate the website known as Imagine Mental Health.

Both organisations are committed to processing all personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Key Principles

We ensure that all personal data is:

• Processed lawfully, fairly, and transparently
• Collected for clear, specific purposes
• Limited to what is necessary
• Accurate and kept up to date
• Retained only as long as needed
• Kept secure and confidential

Data Handling

• All form submissions are stored securely and accessed only by authorised staff.
• Staff and volunteers handling personal data receive appropriate data protection training.
• Data breaches are reported and logged according to ICO guidance.

Special Category Data

Where evaluation or feedback forms include wellbeing or mental health data, explicit consent is obtained. This data is handled confidentially and securely.

Data Retention

• Evaluation data: retained for 2 years, then anonymised.
• Administrative or funding-related data: retained as required by law.

Rights of Individuals

Anyone whose data we hold can:

• Request access, correction, or deletion of their data
• Withdraw consent
• Complain to the ICO if unhappy with our data handling

Contact: office@imagineartsandminds.co.uk

Oversight

Both CICs are responsible for ensuring compliance and maintaining internal records of data processing.
ICO registration details (where applicable) will be published on request.