Your privacy

Who is responsible for your information?

Conviction is an unincorporated association and the controller of personal information collected through this website and used to manage enquiries to us. This means we are responsible for deciding why and how that information is used.

Contact us at contact@conviction.org.uk about data protection. Our Information Commissioner’s Office (ICO) registration reference is ZB782769. You can view Conviction’s entry in the ICO register, including the registered contact details.

This notice covers this website and initial enquiries. Individual support, volunteer recruitment or an agreed project may need further information about how records will be used. We will explain that before asking you to provide further personal information for that activity.

When you visit this website

You can read these pages without sending us information about your circumstances. There is no casework form, document upload or payment facility.

Cloudflare hosts and protects this website. Delivering pages and protecting access involves technical information such as your IP address, browser details and the page requested. We use this information for our legitimate interests in providing a reliable and secure public information service.

We do not use advertising trackers, visitor tracking cookies or embedded media from other websites. Our cookie notice explains the colour preference saved in your browser and removal of the former hosting cookie.

Cloudflare processes website information under its data processing agreement. Its privacy policy explains processing and international transfers.

Choosing Light or Dark saves your colour preference for the current tab’s browser session. The preference is not sent to Conviction. Choose Device to remove it immediately. Some browsers restore session information when a tab is reopened.

Our quick exit feature opens BBC Weather. It cannot erase earlier visits or hide activity from someone monitoring your device.

Email links open your email app. The copy button copies our address to your clipboard. Neither action sends a message to us.

When you email us

We receive your email address, the name you use, your message, any attachments you choose to send and the date and time of your email. We use this to understand your enquiry, reply and decide whether we can help or discuss an opportunity.

Please keep your first message brief. A first name, safe contact details and the kind of help you are looking for are enough to start. Tell us about any restrictions on contacting you without sending the personal details behind them.

Providing information is your choice. If we do not have enough information or a safe way to reply, we may be unable to take your enquiry further. Do not send identity documents, case files, medical records or detailed allegations in your first message.

If someone contacts us for you, we may receive your information from them. They should follow our guidance on enquiring for someone else. We will need to discuss your wishes and authority to share information.

Why we use your information

For ordinary enquiry information, such as contact details and a brief request, our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. Our interest is to respond to people who contact us and manage enquiries about our work. We only need information relevant to that purpose, and you can object to this use.

We also use information when necessary to meet legal obligations under Article 6(1)(c), including handling data protection rights requests and complaints. We may need to confirm your identity before disclosing records, but please do not send identity documents unless we have agreed what is needed.

These bases do not, by themselves, authorise every use of health information or information about criminal allegations and convictions. Additional legal conditions apply to that information.

Who can read your message?

The coordinator and other authorised people at Conviction can access the inbox. It is a shared contact address, so please do not assume that only one named person will read your email. Ask before sending details if this affects what you feel able to share.

Our email provider is Proton AG. Proton says that Proton Mail stores messages on servers in Switzerland, Germany or Norway. These countries are covered by UK adequacy regulations for personal data transfers. You can read Proton Mail’s privacy information for details about message data, security and backups.

Email security also depends on your own provider and device. Using Proton does not mean every message sent to us has encryption between the sender and recipient throughout its journey.

Before involving another organisation in support, we will discuss what needs to be shared and why. We may also have to disclose information where the law requires it. An enquiry is not permission to share your whole story with other services.

How long we keep enquiries

We delete enquiries that do not become support cases within 12 months. This period applies to the enquiries we hold, rather than promising that a provider’s backup disappears at the same moment. Proton says its backups are retained for up to 30 days.

Records for agreed support, volunteering or another continuing activity need a retention period appropriate to that activity. We will explain the relevant arrangements before asking for further records. You can ask about deletion using the contact details below.

Before sharing sensitive information

We understand that even a short enquiry can reveal something personal. Keep it to the kind of help you need, rather than an account of an allegation, diagnosis or court case.

Before sending more, agree what information is needed, who will see it, the legal basis for using it, how it can be sent and when it will be deleted. This website is not a secure service for uploading case documents.

If you have already sent material you did not mean to share, contact us promptly. Do not send another copy of the material to explain the problem.

Your data protection rights

Depending on the circumstances, you can ask to access your personal information, correct it, have it erased or restrict its use. You can object where we rely on legitimate interests. The right to receive and move information in a portable format applies in some circumstances. If we rely on consent for a particular activity, you can withdraw that consent.

These rights have legal conditions and exceptions. Email contact@conviction.org.uk and tell us what you want to do. You do not need to use legal terms or a particular form. We normally respond within one month. If the law allows more time, we will explain why. We may ask for information reasonably needed to deal with your request.

Privacy questions and complaints

If you have a question or think we have mishandled your information, email contact@conviction.org.uk. For a complaint, explain what happened, when and what you would like us to put right. You can use “Data protection complaint” as the subject, but you do not have to.

We will acknowledge a data protection complaint within 30 days of receiving it, investigate without undue delay, keep you informed and explain the outcome. This legal process is separate from the availability of support for an individual case.

If the concern involves someone who reads the inbox, you can ask who will consider it before sending details. We cannot promise an independent reviewer within our small organisation.

You also have the right to complain to the ICO. Its guidance explains how to raise a concern and what information to provide.