Privacy Policy
Document Control
Document owner: Elle Hallaway – Director of Corporate Affairs
Date approved: 7 September 2026
Version: One
Last reviewed: 7 September 2026
Next review: due September 2026
1. Introduction and About This Policy
This privacy policy explains how Beyond the Wire (“we”, “us”, or “our”) collects, uses, stores, and shares your personal data. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), as retained in UK law under the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 (DPA 2018).
This policy is written in clear, plain language in accordance with Article 12 of the UK GDPR, which requires that information provided to data subjects be concise, transparent, intelligible, and easily accessible.
1.1. Introduction and About This Policy
The data controller responsible for your personal data is:
Beyond the Wire
Registered address: 79 Avon Road, Devizes, England, SN10 1PT
Community Interest Company, registered number: 15852940
ICO Registration Number: ZC240199
Data Privacy Manager
We have appointed a Data Privacy Manager who can be contacted as follows:
Name: Roseanna Furphy
Email: hello@bereavementhub.org.uk
Postal address: 79 Avon Road Avon Road, Devizes, England, SN10 1PT
1.2. Scope of This Policy
This policy applies to all personal data we process about the following categories of individuals:
- Website visitors (that contact us via the website contact platform)
- Suppliers and business contacts
- Supporters
- Directors
- Advisors
2. What Information We Collect
We may collect and process the following categories of personal data about you:
| Data | Examples |
|---|---|
| Identity data |
First name, last name, title, date of birth, gender |
| Contact data | Address, email address, telephone number |
| Service | Service (e.g. army/navy etc) of spouse, partner, child, parent, loved one |
| Marketing and communications data | Your preferences in receiving marketing from us and your communication preferences |
3. Special Category Data
Special category data is personal data that requires additional protection. Under Article 9 of the UK GDPR, this includes data revealing:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data (where used for identification purposes)
- Data concerning health
- Data concerning a person’s sex life or sexual orientation
We may collect the following special category data: we process this data on the following lawful basis under Article 9(2) of the UK GDPR: explicit consent (when a user of our services provides the data directly to us).
4. How We Collect Your Information
1.1. Directly from You
- When you fill in forms on our website or correspond with us
- When you enter into a contract with us
- When you subscribe to our services or publications
- When you request marketing materials
- When you provide feedback or contact us
1.2. From Third Parties
- Publicly available sources, such as Companies House or the electoral register
- Social media platforms
5. Legal Bases for Processing
Under Article 6(1) of the UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases we rely on are set out below:
| Lawful Basis | Description | When We Rely on It |
|---|---|---|
| Consent (Art. 6(1)(a)) | You have given clear consent for us to process your personal data for a specific purpose. | e.g. Marketing communications |
| Contract (Art. 6(1)(b)) | Processing is necessary for compliance with a legal obligation to which we are subject. | Regulatory compliance |
| Vital interests (Art. 6(1)(d)) | Processing is necessary to protect the vital interests of you or another person. | e.g. Medical emergencies, safeguarding |
| Legitimate interests (Art. 6(1)(f)) | Processing is necessary for our legitimate interests or those of a third party, except where overridden by your interests, rights, or freedoms. | e.g. Fraud prevention, network security, direct marketing |
6. Purposes of Processing
We process your personal data for the following purposes, mapped to the applicable lawful basis:
| Purpose | Lawful Basis |
|---|---|
| To manage our relationship with you, including notifying you of changes to our terms or privacy policy | Legal obligation |
| To administer and protect Beyond the Wire, our website, and IT systems | Legitimate interests; Legal obligation |
| To deliver relevant content and advertisements to you | Legitimate interests; Consent |
| To use data analytics to improve our website, products, services, marketing, and customer experience | Legitimate interests |
| To make suggestions and recommendations to you that may be of interest to you | Legitimate interests; Consent |
| To comply with legal and regulatory obligations | Legal obligation |
7. Who We Share Your Data With
We may share your personal data with the following categories of recipients:
1.1. Internal Recipients
- Directors and advisers on a need to know basis
1.2. External Recipients
- Service providers acting as our data processors e.g. IT service providers and cloud hosting providers
- Applicable regulators, authorities and governmental ministries and or bodies
In the event we engage third-party processors, we require them to respect the security of your personal data and to treat it in accordance with the law.
8. International Transfers
In the event we transfer your personal data outside the United Kingdom we ensure that an appropriate safeguard is in place to protect your personal data and to ensure that your rights as a data subject continue to be protected, in compliance with Articles 44–49 of the UK GDPR.
9. Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the following factors:
- The amount, nature, and sensitivity of the personal data
- The potential risk of harm from unauthorised use or disclosure of the personal data
- The purposes for which we process the personal data and whether we can achieve those purposes through other means
- Applicable legal, regulatory, tax, accounting, or other requirements
10. Your Rights Under the UK GDPR
Under the UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and are subject to certain exemptions under the DPA 2018:
| Right | Description | UK GDPR Article |
|---|---|---|
| Right of access | You have the right to request a copy of the personal data we hold about you, together with certain supplementary information (a “subject access request” or SAR). | Article 15 |
| Right to rectification | You have the right to request that we correct any personal data that is inaccurate or complete any data that is incomplete. | Article 16 |
| Right to erasure (“right to be forgotten”) | You have the right to request the deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. | Article 17 |
| Right to restriction of processing | You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have challenged. | Article 18 |
| Right to data portability | You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transmit it to another controller, where processing is based on consent or contract and is carried out by automated means. | Article 20 |
| Right to object | You have the right to object to processing based on legitimate interests or a public task. You also have an absolute right to object to processing for direct marketing purposes at any time. | Article 21 |
| Rights related to automated decision-making and profiling | You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects on you, unless certain exceptions apply. | Article 22 |
| Right to withdraw consent | Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. | Article 7(3) |
11. How to Exercise Your Rights
If you wish to exercise any of the rights set out above, please contact us using the following details:
Name: Roseanna Furphy
Email: hello@bereavementhub.org.uk
Postal address: 79 Avon Road Avon Road, Devizes, England, SN10 1PT
We may need to request specific information from you to help us verify your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
We will respond to all legitimate requests within one calendar month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests, in which case we will notify you and keep you updated, in accordance with Article 12(3) of the UK GDPR.
We do not charge a fee to exercise your rights, unless your request is clearly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or refuse to comply with the request, in accordance with Article 12(5) of the UK GDPR.
12. Right to Complain to the ICO
If you are unhappy with how we have handled your personal data or believe that we have not complied with the UK GDPR or the DPA 2018, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.
We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance using the details in Section 11.
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline number: 0303 123 1113
Website: https://ico.org.uk
13. Changes to This Privacy Policy
We may update this privacy policy from time to time. Any changes will be posted on our website at www.beyondthewire.org.uk
We will notify you of any material changes by prominent notice on our website.
We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.
This policy was last updated on 7 September 2026.
14. Children’s Data
We do not knowingly collect personal data from children under the age of 13. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us using the details in Section 11, and we will take steps to delete such data.
15. Automated Decision-Making
We do not use automated decision-making (including profiling) that produces legal effects or similarly significant effects on you.
15. Automated Decision-Making
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those directors, agents, contractors, and other third parties who have a need to know.
