Privacy Notice – The Bear Hug Project CIC

Last updated: October 2026

At The Bear Hug Project CIC we are committed to protecting and respecting your privacy. As a Community Interest Company, transparency and trust are at the heart of what we do.

This Privacy Notice explains how we collect, use, store, and protect your personal data when you interact with us, use our services, visit our website, or engage with our community initiatives.

1. Important information & who we are

The Bear Hug Project CIC is the data controller responsible for your personal data.

  • Organisation name: The Bear Hug Project CIC

  • Company type: Community Interest Company (Registered in England & Wales)

  • Data protection contact: zack@zgmc.co.uk

  • Postal address: 8 Shaw Road, Oldham, OL1 3LQ

If you have any questions about this Privacy Notice or how we handle your personal data, please contact us using the details above.

2. The personal data we collect

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data depending on your interaction with us:

  • Identity data: Name, title, date of birth, username or similar identifier.

  • Contact data: Email address, telephone number, billing address, and delivery address.

  • Special category (sensitive) data: Because of the community support nature of our work, we may occasionally collect information regarding health, wellbeing, or support needs—only with your explicit consent or where necessary to safeguard individuals.

  • Financial data: Payment card or bank account details (processed securely via third-party payment processors if you make a donation or purchase).

  • Transaction data: Details about payments to and from you, as well as details of services or items you have received from us.

  • Technical data: IP address, browser type and version, time zone setting, browser plug-in types, operating system, and platform when you visit our website.

  • Marketing and communications data: Your preferences in receiving updates, newsletters, or marketing from us.

3. How we collect your personal data

We collect data from and about you through:

  1. Direct interactions: You give us your details by filling in forms on our website, signing up for events, requesting support, donating, volunteering, or communicating with us via post, phone, or email.

  2. Automated technologies or interactions: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns using cookies and similar technologies.

  3. Third parties or publicly available sources: We may receive data from platforms like JustGiving, Eventbrite, or social media networks when you interact with our pages or support our fundraising efforts.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we use your personal data under the following lawful bases:

  • Consent: Where you have given explicit permission (e.g., subscribing to a newsletter or sharing personal health/wellbeing context for support services).

  • Contractual necessity: Where we need to perform a contract we are about to enter into or have entered into with you.

  • Legitimate interests: Where it is necessary for our legitimate interests as a CIC (e.g., providing community services, improving our projects, maintaining security) and your rights do not override those interests.

  • Legal obligation: Where we need to comply with a legal or regulatory obligation (e.g., accounting, reporting to Companies House, or safeguarding).

Summary of purposes:

  • Delivering our community projects, events, and support programs.

  • Managing volunteers, donations, and grant funding.

  • Processing payments and Gift Aid declarations (where applicable).

  • Sending newsletters, updates, and event invitations (where requested).

  • Responding to inquiries and feedback.

  • Maintaining safeguarding protocols and ensuring community safety.

5. Disclosures of your personal data

We respect your privacy and do not sell your personal data. We may share your personal data with:

  • Service providers: IT support, website hosting, email management, and payment gateway providers (e.g., Stripe, Mailchimp).

  • Regulators & public authorities: HMRC, Companies House, the CIC Regulator, or local authority safeguarding teams where required by law.

  • Professional advisers: Accountants, auditors, lawyers, or insurers assisting our operations.

All third-party service providers are required to process your personal data in accordance with strict data protection laws and security standards.

6. International data transfers

Where third-party service providers (such as cloud storage or email platforms) process data outside the UK, we ensure a similar degree of protection is afforded by ensuring standard contractual clauses or legally approved frameworks are in place.

7. Data security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. Access to your personal data is limited to staff, volunteers, and partners who have a genuine business or service need to know.

8. Data retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the satisfying of any legal, accounting, or reporting requirements.

  • General inquiries: Retained for up to 1 year after the resolution of your query.

  • Financial & donation records: Retained for 6 years following the end of the tax year (HMRC requirement).

  • Volunteer records: Retained for the duration of your involvement plus 2 years.

9. Your legal rights

Under the UK GDPR, you have rights regarding your personal data, including the right to:

  • Request access to your personal data.

  • Request correction of inaccurate or incomplete data.

  • Request erasure where there is no good reason for us to continue processing it.

  • Object to processing where we rely on a legitimate interest.

  • Request restriction of processing your personal data.

  • Request transfer of your personal data to you or a third party.

  • Withdraw consent at any time where we rely on consent to process your data.

To exercise any of these rights, please contact us.

10. How to complain

If you have any concerns about our data practices, we encourage you to contact us first so we can resolve the issue.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: