How we look after your information

Who we are

MentaSpring CIC is the "data controller" for the personal information described in this policy. That means we decide why and how your personal information is processed.

We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under registration reference ZC175131.

We do not currently have a public postal address. The best way to contact us about anything in this policy is by email: info@mentaspring.org.uk.

What information we collect

We collect personal information when you use our contact form to ask for support, refer someone else, or get in touch for another reason. This can include:

• your first and last name;
• your email address;
• the reason for your enquiry (for example, support for myself; referring or enquiring about someone else; family or carer enquiry; professional or organisation enquiry; general enquiry);
• whatever you tell us in the free-text message, which may include sensitive details about your health, wellbeing or personal circumstances.

If you use our referral form (Refer Someone), we also collect your name, role, organisation, email address and phone number, along with the name and contact details of the person you are referring, whether they have agreed to the referral, your reason for referring them and any safeguarding concerns you tell us about. Please only give us information about another person that you are able to share.

Cookies

This website does not use cookies, analytics software or any tracking technology to monitor visitors, and we do not set advertising or marketing cookies.

Our web pages do load typefaces from Google Fonts so that text displays correctly. Loading a font involves your browser connecting directly to Google's servers, which will process your IP address as part of that connection. We do not control this processing; you can read Google's explanation of it in the Google Privacy Policy.

Why we collect it, and our lawful basis

We use your information to respond to your enquiry, work out what support may help, and provide any signposting or follow-up you ask for. Where you are contacting us on behalf of someone else, we use the information to understand how to help that person too.

Under UK GDPR, our lawful basis for this is:

• Consent (Article 6(1)(a)) — by filling in and submitting the form, you are asking us to use the information you've given us to get back to you; and
• Legitimate interests (Article 6(1)(f)) — where relevant, in running a community support organisation and responding to people who contact us, in a way that does not override your own rights and interests.

You can withdraw your consent at any time by emailing us; this will not affect anything we have already done based on it.

Health information and special category data

If you choose to tell us about a mental health condition, disability or other health-related matter in your message, this counts as "special category data" under UK GDPR — a category that gets extra legal protection because it is sensitive.

We only hold this information because you have chosen to share it with us, in order to ask for support. Our lawful condition for processing it is your explicit consent (Article 9(2)(a) UK GDPR), given by voluntarily including it in your message to us.

Please only share what you think we need to understand your situation. MentaSpring is not a crisis or clinical service, so please do not use the form to describe an emergency — if you or someone else is in immediate danger, call 999, and see our safeguarding information for other urgent contacts.

Who we share your information with

We do not sell your information, and we do not share it for marketing purposes. We do use a small number of other organisations to run this website and handle enquiries:

• Formspree, a form processing service, receives and delivers the messages submitted through our contact and referral forms so that we can read and reply to them. You can read their privacy policy.
• Vercel, our website hosting provider, may process technical information (such as IP addresses in server logs) as part of running this website. You can read their privacy policy.

We may also need to share information where the law requires it, or where there is a serious safeguarding concern — this is described in our Safeguarding page.

How long we keep your information

We keep enquiry information, including messages submitted through our contact and referral forms, for 12 months from your last contact with us, and then delete it.

If you go on to receive ongoing support from MentaSpring, we keep your information for as long as you remain engaged with our programmes, and for a further period afterwards so we can maintain accurate records of the support we provided. We will delete or anonymise it once it is no longer needed.

Your rights

Under UK GDPR, you have the right to:

• ask us for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your information;
• ask us to restrict how we use your information;
• ask us for a copy of your information in a portable format, where this applies;
• object to us using your information; and
• withdraw consent you have previously given, at any time.

To use any of these rights, email info@mentaspring.org.uk. We will respond within one month.

How to complain

We hope you would come to us first if you have a concern about how we've handled your information, so we can try to put it right — email info@mentaspring.org.uk.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection:

• Online: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this policy

We may update this policy as MentaSpring's programmes develop. Any changes will be published on this page.

Last updated: 4 October 2026.