This privacy notice tells you what to expect us to do with your personal information.

• Contact details
• What information we collect, use, and why
• Lawful bases and data protection rights
• Where we get personal information from
• How long we keep information
• Who we share information with
• Sharing information outside the UK
• How to complain

Email info@questoflife.org

We collect or use the following information to provide services and goods, including delivery and third party referrals:

• Service use history
• Overall Well-being and Progress Questionnaires
• Information about accessibility requirements and reasonable accommodations
• Records of meetings and decisions
• Website user information (including user journeys and cookie tracking)
• Information relating to feedback or complaints
• Information about clients' attendance at coaching sessions
• Evaluation forms and progress reports for trainee facilitators

We collect or use the following information to receive donations or funding and organise fundraising activities:

• Names and contact details
• Donation history

We collect or use the following personal information for service updates or marketing purposes:

• Names and contact details
• Marketing preferences
• Purchase history
• Donation history
• Website and app user journey information
• Records of consent, where appropriate

We collect or use the following personal information for research or archiving purposes:

• Names and contact details
• Addresses
• Purchase history
• Donation history
• Website and app user journey information
• Records of consent, where appropriate
• Survey responses
• Facilitator notes

We also collect or use the following information for research or archiving purposes:

• Progress and other questionnaire submissions

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Payment details
• Account information
• Purchase or service history
• Relevant information from previous investigations
• Customer or client accounts and records
• Financial transaction information
• Information relating to health and safety (including incident investigation details and reports and accident book records)
• Correspondence

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
• Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
• Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods, including delivery and third party referrals are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Ensuring smooth and effective service delivery, including group and 1:1 coaching, facilitation, and community support.
  • Maintaining records of participation to improve program quality and accessibility.
  • Connecting clients with relevant third-party services or resources that align with their needs.
  • Preventing misuse of services and ensuring the safety and well-being of all participants.
• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information to receive donations or funding and organise fundraising activities are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
• Acknowledging and expressing appreciation for donations, including thank-you emails and updates on the impact of contributions.
• Keeping records of donor engagement to improve fundraising strategies and maintain relationships with supporters.
• Ensuring compliance with financial and legal obligations related to funding and donations.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information for research or archiving purposes are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Safeguarding and quality assurance to ensure the effectiveness and ethical operation of our programs.
  • Evaluating service impact and improving future offerings through anonymous or aggregated data analysis.
  • Documenting best practices and learnings for internal training and development.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Safeguarding participants and addressing any concerns related to inappropriate behavior or rule violations.
  • Resolving disputes fairly and efficiently while maintaining accurate records of complaints and resolutions.
  • Protecting the organization from legal or reputational risks by documenting and addressing concerns appropriately.
• Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

• Directly from you
• Third parties:
  • Discord data (e.g. servers)
  • Online Forms (e.g. service feedback)

One week after the group sessions conclude, we are no longer responsible for the privacy or management of client chat logs and other discussions. While the Discord server may remain active indefinitely or be transferred to a client member for management, Quest of Life CIC will no longer oversee or be accountable for its content or security.

Other personal data will be retained for as long as the Organization is active or until it is determined that the information is no longer of use. We will review our data retention practices at least once a year to identify and securely delete data that is no longer needed.

• Access to full personal data is restricted to the operational team.
• Selected volunteers may access limited data, such as attendance records and anonymized feedback.
• We may share data with third-party service providers, including Google Drive, ClickUp, and payment processors (e.g., Stripe, Wise) for operational purposes.

Others we share personal information with

• Emergency services
• Organisations we’re legally obliged to share personal information with
• Publicly on our website, social media or other marketing and information media
• Suppliers and service providers

Personal data may be accessed by authorized personnel outside of the UK. We do not transfer personal data outside the European Economic Area (EEA) except as necessary to provide our services, maintain operations, or comply with legal obligations.

We use third-party service providers, including Google Drive and ClickUp, which may store and process data on servers located outside the UK/EEA. When transferring personal data internationally, we ensure compliance with UK GDPR by implementing appropriate safeguards, including:

• Adequacy Decisions – Where personal data is transferred to countries recognized by the UK government as providing adequate data protection.
• Standard Contractual Clauses (SCCs) – Where no adequacy decision exists, we rely on legally binding agreements with third-party providers to ensure UK GDPR-compliant data protection.
• Technical & Organizational Measures – We implement encryption, access controls, and pseudonymization where feasible to protect personal data.

By using our services, you acknowledge that personal data may be stored and processed outside the UK/EEA with appropriate safeguards in place. If you have concerns about how your data is handled, please contact us using the contact details at the top of this privacy notice.

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

• Information Commissioner’s Office
• Wycliffe House
• Water Lane
• Wilmslow
• Cheshire
• SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

09 February 2025