Privacy notice

What we do with
your information.

This notice covers people who use this website, make an enquiry or referral, or apply for a job with us. Young people we support get their own, fuller privacy notice when they arrive — this page is not that notice.

Last updated: 18 August 2026.

Important

Don't send us anything sensitive through this website

This site has no forms, on purpose. If you are making a referral, please don't put a young person's identifying or special category information into a first email: no dates of birth, immigration status, health or mental health information, offending history, or detailed risk information.

Tell us enough to know whether we can help, and we will agree a secure route for the rest before you send it. Email is not a secure channel and we won't pretend it is.

Who we are

The data controller

Registered name
Ember Support Project Ltd
Trading as
The Ember Project
Company number
17376400, registered in England and Wales
Registered office
15 & 17 Rombourne Business Centre, Moy Road, Taffs Well, CF15 7QR
ICO registration
ZC226478
Data protection contact
privacy@the-emberproject.co.uk

The registered office is a business address for correspondence. It is not one of our houses, and no young person lives or is supported there.

What we collect

Four things, and no more

Website use Anonymous usage statistics. Which pages are read, which links are clicked, and roughly how far down a page people get. This is collected without cookies and without building a profile of you — we cannot identify individual visitors from it, and we do not try to. See our cookie notice for the detail.
Enquiries Whatever you put in your email, plus your email address and any signature block. If you are a professional making a referral, that will usually be your name, role, team and contact details.
Job applications Your CV, your covering note and your contact details. If you are appointed, we will then collect what safer recruitment requires — references, full employment history and an enhanced DBS check — and we will tell you about that separately at the time.
Booking a meeting Your name, email address and chosen time, if you use the booking calendar. That is handled by Cal.eu on our behalf.
If we contact you Your name, role, organisation and work contact details, where we approach a commissioning, placement or leaving care team about what we provide. We collect that from published sources — council websites, directories, professional networks — or from someone at your organisation passing it on. We contact people in their professional capacity about a service relevant to their work; we do not buy contact lists, and we don't email people at home.

Why, and on what basis

Our lawful bases

  • Legitimate interests — running and improving this website, responding to enquiries and referrals, managing recruitment, and telling commissioning and placement teams that this service exists. We have weighed your interests against ours, which is why the analytics are anonymous, why we write to people about their work rather than at home, and why one line back stops it permanently.
  • Contract — where we are taking steps at your request before entering into a placement agreement or a contract of employment.
  • Legal obligation — safeguarding, safer recruitment and record-keeping duties, and responding to lawful requests.

We do not sell your information, we do not use it for advertising, and we do not make automated decisions about you.

If we've written to you and you'd rather we didn't

Reply with "no thanks" — that is enough, and you don't need to explain. We'll remove you and keep a note of the fact that you asked, so nobody here writes to you again by accident. That note is the only reason we keep anything about you after that point.

privacy@the-emberproject.co.uk

Who else touches it

Our processors

These are the services that handle information on our behalf. They are bound by contract to act only on our instructions.

Microsoft 365
Email and calendars, hosted in the UK and EU
PostHog
Anonymous website statistics, EU-hosted
Cal.eu
Meeting bookings, EU-hosted
Our web host
Serving this website

We will also share information where we are required to by law, or where safeguarding makes it necessary — a concern about a child or an adult at risk will always be shared with the people who need to act on it, and we will not seek consent first if doing so would increase risk.

How long we keep it

Retention

Enquiries that go nowhere
12 months, then deleted
Referrals and placement records
As required by statutory guidance and our contract with the placing authority
Unsuccessful job applications
6 months, then deleted
Professional contacts we approached
24 months from the last contact, then deleted — or straight away if you ask, apart from a note that you did
Anonymous website statistics
Retained in aggregate; there is nothing in it to identify you

Your rights

What you can ask us to do

  • See what we hold about you, and get a copy of it.
  • Have it corrected if it is wrong, or completed if it is partial.
  • Have it deleted, where we have no continuing reason or legal duty to keep it.
  • Object to us using it, or ask us to restrict how we use it, while a dispute is sorted out.
  • Ask for it in a portable format, where the right applies.

Email privacy@the-emberproject.co.uk and we will respond within one month. There is no charge.

If we get it wrong

Complaining about us

Tell us first if you can — privacy@the-emberproject.co.uk — but you do not have to, and you do not need our permission to go elsewhere.

You can complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, or 0303 123 1113.

If your concern is about the care of a young person rather than about data, the routes on our safeguarding page are the ones to use.