GDPR Policy

1. Introduction

Transform Recovery is committed to protecting the privacy, security and integrity of the personal information we process. We recognise the importance of safeguarding personal data and are committed to processing it fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

This policy outlines our commitment to data protection and explains how we collect, process, store and protect personal information.

2. Our Commitment

Transform Recovery is committed to:

Processing personal data lawfully, fairly and transparently.
Collecting personal information only for specified and legitimate purposes.
Collecting only the personal information necessary to fulfil those purposes.
Keeping personal information accurate and up to date.
Protecting personal information using appropriate technical and organisational security measures.
Retaining personal information only for as long as necessary.
Respecting the rights of individuals under UK GDPR.
Regularly reviewing our data protection practices to maintain compliance.

We recognise that some enquiries may include information relating to an individual's physical or mental health, addiction or treatment needs. Where this information is processed, we do so in accordance with the additional protections required for special category personal data under UK GDPR.

3. Personal Information We Process

Depending on how you use our website or contact us, we may process:

Name.
Email address.
Telephone number.
Postcode.
Details of your enquiry.
Information relating to addiction, treatment requirements or recovery support where you choose to provide it.
Communications between you and us.
IP address.
Browser type and version.
Device information.
Website usage information.
Information collected through cookies and analytics technologies where applicable.

4. Why We Process Personal Information

We process personal information to:

Respond to enquiries.
Help individuals find suitable addiction treatment and rehabilitation services.
Connect users with carefully selected rehabilitation providers where requested.
Manage customer communications.
Improve our website and user experience.
Monitor website performance and security.
Prevent fraud and misuse.
Maintain business records.
Comply with legal and regulatory obligations.

Where appropriate, enquiries may be shared with carefully selected rehabilitation providers so they can contact you directly regarding your enquiry and discuss suitable treatment options.

We do not sell personal information to third parties.

5. Lawful Bases for Processing

We process personal information under one or more of the following lawful bases:

Consent.
Performance of a contract.
Legitimate interests.
Compliance with legal obligations.

Where you voluntarily provide information relating to your health or addiction, we process this information only where permitted under Article 9 of the UK GDPR, including where you have given explicit consent or where processing is necessary to provide the services you have requested.

Where processing is based on consent, you have the right to withdraw that consent at any time.

6. Data Sharing

We only share personal information where it is necessary to respond to your enquiry, provide the services you have requested or where we are legally required to do so.

Recipients may include:

Carefully selected rehabilitation providers.
Website hosting providers.
IT support providers.
Analytics providers.
Cloud storage providers.
Professional advisers.
Government bodies, regulators or law enforcement agencies where required by law.

We require all organisations handling personal information on our behalf to process it securely and in accordance with applicable data protection legislation.

7. Data Security

Transform Recovery takes appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, misuse, alteration, disclosure or destruction.

Our security measures may include:

Secure website hosting.
SSL encryption.
Password-protected systems.
Restricted access to personal information.
Secure storage of electronic records.
Regular software updates and security monitoring.

Although no system can guarantee absolute security, we continually review and improve our security practices to reduce risk.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal and regulatory obligations.

Typical retention periods include:

Enquiries. Up to 12 months.
Customer records. Up to 6 years where required for legal or accounting purposes.
Marketing records. Until consent is withdrawn, where applicable.

Personal information is securely deleted or anonymised once it is no longer required.

9. Your Rights

Under UK GDPR, you have the right to:

Request access to your personal information.
Request correction of inaccurate or incomplete information.
Request erasure of your personal information where applicable.
Request restriction of processing.
Object to the processing of your personal information.
Request the transfer of your personal information where applicable.
Withdraw your consent where processing is based on consent.
Lodge a complaint with the Information Commissioner's Office (ICO).

We will respond to requests relating to personal information without undue delay and within the timescales required by law.

10. International Data Transfers

Where personal information is transferred or processed outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with UK GDPR to protect your personal information.

11. Personal Data Breaches

We have procedures in place to identify, investigate and respond to any actual or suspected personal data breach.

Where required by law, we will notify the Information Commissioner's Office and affected individuals within the timescales required under UK GDPR.

12. Policy Review

This GDPR Policy is reviewed periodically to ensure it remains accurate, effective and compliant with current legislation and our business practices.

Any updates will be published on this page with an updated effective date.

13. Contact Us

If you have any questions about this GDPR Policy or how Transform Recovery processes personal information, please contact us using the contact details or enquiry form available on our website.