Privacy Notice

Who we are

Roads to Recovery CIC ("R2R", "we", "our", "us") is a Community Interest Company registered in England and Wales, company number 17023107. We deliver the New Roads Ahead programme and related services in Gloucestershire.

We are the data controller for personal information you share with us. Our contact details are at the bottom of this page.

What this notice covers

This notice explains what personal information we collect, why we collect it, what we do with it, who we share it with, and your rights. It applies to:

• Visitors to this website
• People who contact us through the contact form, email, or phone
• People referred to us (or who refer themselves) for the New Roads Ahead programme
• Referring professionals (probation officers, VIA workers, GPs, other services)
• Volunteers, funders, partners, and collaborators

What information we collect

When you visit this website

This site is a simple static website. We do not use cookies, tracking pixels, or analytics scripts. We do not build a profile of your visit. Your browser will make standard requests to our hosting provider (Netlify) and to Google Fonts to load the site's fonts — these are logged by those providers for security and abuse prevention but are not used by us.

When you use the contact form

The contact form on this site is handled by Formspree, a form service we use to deliver your message to us by email. When you submit the form, Formspree processes:

• Your name
• Your email address
• The nature of your enquiry
• The content of your message

Formspree forwards this to our R2R inbox and retains the submission on their servers under their own privacy policy.

When you are referred to the programme

If you are being considered for New Roads Ahead, we collect information we need to keep you — and others — safe, and to deliver the programme well. This typically includes:

• Name, contact details, and date of birth
• Referrer details (probation officer, key worker, GP, or self-referral)
• Relevant risk and safeguarding information shared by the referrer
• A brief recovery / offending / health background as relevant to the programme
• Any access needs, health conditions, or reasonable adjustments we should know about
• Emergency contact details

On the programme itself we also keep attendance records, engagement notes, workbook exercises (where you choose to share them with us), and survey responses (Week 1, Week 6, Week 12).

Why we collect it (lawful basis)

Under UK GDPR, we need a lawful basis for collecting and using personal information. Ours are:

• Legitimate interests — to operate R2R, respond to enquiries, and deliver the programme safely and effectively.
• Consent — where you actively sign up, opt in, or agree to something (for example, signing onto the programme, or joining a mailing list).
• Legal obligation — to meet safeguarding, health & safety, and reporting duties.
• Vital interests — where we believe someone is at immediate risk of serious harm.

We handle health, offending, and other sensitive information under the additional conditions in UK GDPR Article 9 and the Data Protection Act 2018, typically on the basis of explicit consent or substantial public interest (safeguarding, rehabilitation, and crime prevention).

Who we share it with

We share the minimum needed, only with people who need to know, and only for reasons you would reasonably expect given the referral:

• Your referring organisation (probation, VIA, GP practice, etc.) — for coordination and to confirm engagement
• R2R facilitators and safeguarding staff who deliver the programme
• Activity partners (e.g. Pedal a Bikeaway, Wyedean Canoe Club, Rejoov) — only the information needed to book and run your session safely
• Emergency services, local authority safeguarding teams, or police — only where there is a safeguarding concern or legal duty
• Funders and commissioners — only in an anonymised, aggregated form (for example, "14 participants completed the programme this quarter")

We do not sell personal information. We do not share it for marketing purposes.

How long we keep it

• Contact form enquiries: up to 12 months, then deleted.
• Referral information for participants who do not start the programme: up to 6 months, then deleted.
• Participant records during and after the programme: up to 6 years after last contact, to meet safeguarding, insurance, funder, and legal obligations.
• Anonymised, aggregated programme data: kept indefinitely to evidence impact and inform commissioning.
• Safeguarding records: kept in line with local authority guidance (typically longer, where required).

How we keep it safe

Personal information is stored on password-protected accounts with reputable UK/EU/US providers (Google Workspace, Formspree, and similar). Access is restricted to R2R staff who need it. Paper records (for example, during a session) are kept securely and destroyed or digitised when no longer needed on paper. We train anyone who handles personal information to a basic standard of data protection and safeguarding.

Your rights

Under UK GDPR, you have the right to:

• Ask what personal information we hold about you (a "subject access request")
• Ask us to correct information that is wrong
• Ask us to delete information we no longer need to keep (subject to our safeguarding and legal duties)
• Ask us to restrict or object to certain uses
• Withdraw consent at any time, where we rely on consent
• Complain to the Information Commissioner's Office (ICO)

Children and young people

R2R services are for adults aged 18 and over. We do not knowingly collect personal information about anyone under 18. If you believe we hold information about a person under 18, email us and we will review and delete as appropriate.

Changes to this notice

We review this notice at least once a year. Any significant changes will be flagged at the top of this page. The version date is always shown at the top.

Contact us about privacy