GDPR Policy

Who We Are

CoLab Worcs CiC is the data controller for personal information collected through our website, events, and programmes. We are registered in England and Wales as a Community Interest Company. You can reach us at hello@colabworcs.com.

What Data We Collect

We collect only what we need to run our community programmes safely and effectively. This may include:

• Name, email address, and phone number — collected when you sign up to our newsletter, register for a workshop, or book a Forest Therapy session.
• Emergency contact details and relevant health information — collected only for events where participant safety requires it, and held only for the duration of that event.
• Anonymised participation data — used for our CiC reporting obligations. No individual is identifiable in any report we produce.

Our Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

• Consent — for newsletter sign-ups and optional communications. You may withdraw consent at any time by emailing hello@colabworcs.com or clicking unsubscribe.
• Legitimate interests — for managing bookings and communicating directly about sessions you have registered for.
• Vital interests — for health and emergency contact information held during events, where the safety of participants requires it.

How We Store Your Data

Personal data is stored securely in Google Drive, accessible only to CoLab Worcs directors. We do not store payment card details — any payments are processed by third-party providers subject to their own GDPR compliance. Event health and emergency contact records are deleted promptly once the event concludes.

How Long We Keep Your Data

We keep contact and booking records for no longer than two years after your last interaction with us, or until you ask us to delete them — whichever comes first. Health and emergency contact data gathered for a specific event is deleted within 30 days of that event ending.

Third Parties

We use Google Workspace to store and manage our documents. Google acts as a data processor on our behalf and is bound by a Data Processing Agreement. We do not sell, rent, or share your personal data with any other third parties for marketing purposes.

Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data where there is no compelling reason to keep it.
• Restriction — ask us to pause processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at hello@colabworcs.com. We will respond within one month.

Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with a revised date. For significant changes we will notify active members by email where possible.