Unspoken But Heard CIC

Privacy notice

Your information and your choices.

Last updated: 7 September 2026

Controlled-testing notice

This notice describes the current website and prototype. The lawful bases for support data, special category data conditions, supplier and international-transfer details, and final retention schedule still require approval before a live pilot.

This is not the final live-service privacy notice and live support is not currently open.

Who is responsible

UNSPOKEN BUT HEARD CIC is the data controller responsible for personal information handled through this website.

UNSPOKEN BUT HEARD CIC A Community Interest Company, registered in England and Wales. Company number: 17432454 · Private company limited by guarantee.

Registered office: Ground Floor, 108-112 Main Street, Sundridge, Sevenoaks, United Kingdom, TN14 6ES.

For privacy questions or a request about your personal information, write to the registered office marked “Privacy”, or use the concerns form and select the privacy category.

Include a safe way for us to reply if you want a response. You do not need an account to raise a concern.

Information the service handles

Depending on how you use the service, we may handle:

• Account details: name, email address, protected password representation, sessions and account-access records.
• Support requests and conversations: messages you choose to send, participants, timestamps and conversation status.
• Safeguarding information: concerns, relevant conversation context, review notes and records of authorised access.
• Complaints and volunteer applications: information you submit and any contact details you provide.
• Service operation and security information: audit records, availability and queue timing, technical and security logs, and notification subscription details if enabled.

Support conversations may contain information about your physical or mental health, pregnancy or pregnancy loss. This may be special category personal data under UK data protection law and receives additional legal protection.

Please share only what you feel is necessary and avoid identifying other people unnecessarily.

Why information is used

Information is used to:

• Manage user accounts and access to the service.
• Connect people requesting support with Support Companions.
• Deliver and manage support conversations.
• Identify and review safeguarding concerns.
• Handle complaints and concerns.
• Process volunteer applications.
• Operate, secure and improve the reliability of the service.
• Maintain appropriate security and audit records.

Before live support begins, UNSPOKEN BUT HEARD CIC will document the appropriate UK GDPR lawful basis for each processing purpose and, where special category personal data is processed, the applicable additional condition.

These decisions remain part of the launch review.

Simply using this website does not amount to consent to every use of your personal information.

Who can see your information

Access to personal information within the service is restricted according to role and responsibility.

• Support Companions can access conversations assigned to them where required to provide support.
• Authorised safeguarding personnel can access relevant information where required to review or manage a safeguarding concern.
• Authorised operational personnel may access information where required for service administration, security, complaints or support.
• Approved technology providers may process information where necessary to provide hosting, database, email, notification or other infrastructure services.

The final approved provider list, processing locations and any required international-transfer safeguards will be confirmed before live support begins.

Information may also be shared with emergency services, safeguarding authorities or other appropriate organisations where this is necessary, proportionate and lawful, including where there is a serious safeguarding concern or legal requirement.

Confidentiality is therefore not absolute.

Human review and automated tools

Support conversations are not used for advertising, AI training or sentiment analysis.

The service may use automated phrase matching to identify messages that could require safeguarding attention.

Where enabled, phrase matching may flag a message for restricted human review.

It does not:

• Diagnose a medical or mental health condition.
• Determine whether somebody is at risk.
• Assign an automated safeguarding risk level.
• Make a safeguarding decision.
• Automatically contact emergency services.

Safeguarding decisions are made by authorised people.

How long information is kept

We do not intend to keep personal information for longer than it is reasonably required.

The prototype includes configurable cleanup of ended conversations and allows relevant records to be placed under a safeguarding hold where necessary.

The final retention periods for accounts, conversations, safeguarding records, complaints, volunteer applications, security and audit records, and backups are still being determined.

Retention periods will take account of:

• Why the information was collected.
• Safeguarding requirements.
• Legal and regulatory requirements.
• Security and accountability requirements.
• Whether information is required in connection with a complaint, concern or legal claim.

The final retention schedule will be approved before live support begins.

We cannot promise immediate deletion of every copy of information, particularly where information exists within backups, security records or records that must lawfully be retained.

Your rights

Depending on the circumstances and the legal basis being relied upon, UK data protection law may give you rights relating to your personal information.

These can include the right to:

• Ask for access to your personal information.
• Ask for inaccurate information to be corrected.
• Ask for information to be erased in certain circumstances.
• Ask us to restrict how information is used in certain circumstances.
• Object to certain uses of your information.
• Receive certain information in a portable format where the right to data portability applies.

Where processing relies on consent, you can withdraw that consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Not every right applies in every circumstance. There may also be legal reasons why particular information must be retained.

We may need to verify your identity before responding to a request.

Privacy questions and complaints

If you have a question about your personal information or believe it has been handled incorrectly, please contact us using the routes described above.

You can also complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Cookies and browser storage

Our website may use cookies, local storage or similar browser technologies where required to operate the service.

Read our cookies and storage notice for details about the technologies currently used and the choices available to you.

Changes to this notice

We will update this privacy notice as the service develops.

A complete live-service privacy notice will be published before live support begins.

That notice will include the approved lawful bases, special category data conditions, retention arrangements, relevant service providers and international-transfer information applicable to the live service.