This Privacy Policy explains how Trauma Informed Change Consultancy Services Ltd collects, uses, stores and protects personal data obtained through our websites, scorecards, emails and services. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.
1.Who we are
Trauma Informed Change Consultancy Services Ltd (“TICCS Ltd”, “we”, “us”, “our”) is a professional consultancy providing bespoke safeguarding and implementation services to public sector agencies, educational institutions, charities and businesses. We are the data controller for the personal data described in this policy.
- Company name
- Trauma Informed Change Consultancy Services Ltd
- Company number
- SC820559
- Registered in
- Scotland
- Registered office
- 41 Ocein Drive, East Kilbride, Glasgow, Scotland, G75 8RJ
- Websites
- trauma-informed-change.co.uk and ticcsltd.co.uk
- office@ticcsltd.co.uk
We are not required to appoint a Data Protection Officer. Please send any data protection question, request or complaint to office@ticcsltd.co.uk.
2.What personal data we collect
We collect only the personal data we need for the purposes in this policy.
2.1Information you give us
- Your name and email address
- Your organisation and your role or job title
- Details about your organisation, such as its type and approximate size
- Your phone number, where a form asks for it, and whether you are happy to be phoned
- What your enquiry is about, what prompted it and how you heard about us
- The content of any enquiry or message you send us
- The details you give when you book a scoping conversation, including the time you choose
- Your answers to our scorecards and questionnaires
2.2Information created when you complete a scorecard
- Your overall score, section scores and results category
- Which scorecard you completed and how you reached it (for example, which QR code, link or campaign)
- Whether you opted in to marketing emails, and when
2.3Information from our emails
- Whether our emails were delivered, opened and which links were clicked (see Section 7.5)
- Unsubscribe requests and your email preferences
2.4Information collected automatically on our websites
- IP address, held in our hosting provider's server logs (Google Analytics does not store it)
- Browser type and version, device type and operating system
- Pages visited and time spent on our websites
- The website or search terms that referred you to us
- Date and time of your visit
Analytics information is only collected if you accept analytics cookies (see Section 7).
2.5Business contact details from public sources
The names, job titles and work contact details of people at organisations that may benefit from our services, taken from public registers and organisation websites (see Section 3.7).
2.6What we do not collect
- Payment or financial information through our websites or scorecards
- Government-issued identification numbers
- Special category data (such as health, ethnicity, religion or sexual orientation) or criminal offence data through our websites or scorecards
- Data from children
Our scorecards ask about your organisation's policies and practice, not about you personally. Please don't include personal or sensitive details about yourself or others in free-text answers or messages.
3.How we collect your data
3.1Website forms
Our website contact and booking forms use EmailJS, a third-party email delivery service. When you submit a form, the details you enter (such as your name, email address, phone number, organisation and message) are sent securely via EmailJS to our business email inbox. They are not stored on our website servers.
3.2Booking a scoping conversation
After you submit our booking form, you can choose a time for your scoping conversation in a booking calendar provided by Calendly, an online scheduling service. Calendly records your name, email address, the time you choose and any answers you give in the calendar, and sends us the booking details.
3.3Scorecards and questionnaires
We use ScoreApp to run online scorecards. You may reach them through our website, a link in an email or post, or a QR code on our printed materials. When you complete one, ScoreApp records your contact details and answers, calculates your score and shows you your results. ScoreApp then passes your details, answers, score and marketing preference to our HubSpot account.
3.4Our contact database and email platform
We use HubSpot as our contact database (CRM) and to send emails. This includes your scorecard results email and, if you opted in, automated follow-up emails. HubSpot records the emails we send you and, where we measure it, whether they were opened or clicked.
3.5Website analytics
We use Google Analytics to understand how visitors use our websites, so we can improve their content. It only runs if you accept analytics cookies.
3.6Direct communication
If you contact us by email, phone or post, or give us your details at an event or meeting, we collect the personal data you provide.
3.7Public sources
We may collect the work contact details of people at organisations we think may benefit from our services, from public registers (such as the Care Inspectorate's register of care services) and organisation websites. If we contact you this way, our first message will tell you where we got your details and how to opt out.
4.Legal basis for processing
UK GDPR requires a lawful basis for each use of personal data. Ours are below.
| What we do | Lawful basis |
|---|---|
| Responding to enquiries and messages, and arranging scoping conversations you book | Legitimate interests |
| Running scorecards: recording your answers and calculating and sending your results | Legitimate interestsProviding the results you asked for |
| Using your score and answers to choose which resources and emails are most relevant to you | Legitimate interests |
| Sending marketing emails to people who opted in, and measuring opens and clicks of those emails | |
| Emailing people at organisations, at their work address, about relevant services (including contacts from public sources) | Legitimate interests |
| Analytics cookies, and any other non-essential cookies | |
| Keeping a suppression list so we don't contact you after you unsubscribe or object | Legitimate interests |
| Providing consultancy services to clients | Contract (Article 6(1)(b)) |
| Keeping financial and tax records, and handling rights requests and complaints | Legal obligation |
Legitimate interests (Article 6(1)(f)). Our interests are running and growing a professional consultancy, responding to enquiries and improving our services. We have assessed that these are not overridden by your rights, given the business context and the easy ways to opt out. You can ask us for details of that assessment.
Consent (Article 6(1)(a)). Where we rely on consent, you can withdraw it at any time (see Section 9.9).
Contract. Client work is also governed by a separate data processing agreement and/or our terms of engagement.
5.How we use your data
We use your personal data to:
- Respond to your enquiries and messages
- Show and send you your scorecard results, and follow up on anything you ask for
- Tailor resources and emails to your scorecard results
- Send marketing emails, as described below
- Communicate with you about our services, proposals or ongoing work
- Understand which campaigns, links and QR codes bring people to us, and improve our websites and scorecards
- Fulfil contractual or pre-contractual obligations
- Comply with our legal and regulatory obligations
We will never sell, rent or trade your personal data.
5.1Scoring and tailored content
Your scorecard answers are scored automatically, and we use the result to decide which resources or emails are most relevant to you. This is a form of profiling. It does not lead to any decision with legal or similarly significant effects on you, and you can object to it at any time (Section 9.6).
5.2Marketing emails
- Scorecards and forms: we only send you marketing emails if you tick the opt-in box. Without it, you receive your results and any reply you asked for, nothing more.
- Business contacts: we may email people at organisations, at their work address, about services relevant to their role, where the law allows this without prior consent. We do not send unsolicited marketing to personal email addresses or to sole traders without consent.
- Every marketing email identifies us and includes an unsubscribe link. You can object to marketing at any time and we will stop (Section 9.7).
8.How long we keep your data
We keep personal data only as long as we need it for the purposes it was collected for, or as the law requires.
| Information | How long we keep it |
|---|---|
| Contact form enquiries and general email correspondence | 24 months from our last contact, unless an ongoing business relationship exists |
| Scorecard answers and results (ScoreApp) | 24 months from when you completed the scorecard |
| Contact records in HubSpot | 24 months from your last interaction with us (such as completing a scorecard, replying to an email or meeting us), unless you are a client |
| Business contacts from public sources who don't respond | 24 months from when we collected them |
| Record of your marketing consent | While we rely on it, plus 2 years so we can show we had it |
| Suppression record after you unsubscribe or object (email address and date only) | For as long as we send marketing, so we never contact you again by mistake |
| Client and contractual records, and emails about a client engagement | 7 years from the end of the engagement, in line with tax and company law |
| Google Analytics data | 14 months, then deleted automatically |
When we no longer need personal data, we securely delete or anonymise it.
9.Your rights under UK GDPR
You have the rights below. To use any of them, email office@ticcsltd.co.uk. There is no charge unless a request is manifestly unfounded or excessive.
9.1Right of access
You can ask for a copy of the personal data we hold about you. We will carry out reasonable and proportionate searches and respond within one calendar month. For complex or numerous requests we may extend this by up to two further months, and will tell you if so. If we need proof of identity or clarification, the time limit starts once we have it.
9.2Right to rectification
You can ask us to correct personal data that is inaccurate or incomplete.
9.3Right to erasure
You can ask us to delete your personal data where there is no compelling reason to keep it, subject to records we must keep by law. If you ask us to stop all contact, we will keep your email address on a suppression list so we don't contact you again.
9.4Right to restrict processing
You can ask us to pause the use of your data in certain circumstances, for example while we check its accuracy or consider an objection.
9.5Right to data portability
Where we process your data by automated means based on your consent or a contract, you can ask for it in a structured, commonly used, machine-readable format.
9.6Right to object
You can object to processing based on our legitimate interests, including the scoring of your scorecard answers. We will stop unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.
9.7Right to object to direct marketing
You can tell us to stop sending you marketing at any time, using the unsubscribe link in any email or by emailing us. We will always stop. This includes any profiling we do for marketing.
9.8Automated decision-making
Our scorecards calculate your score automatically, but we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
9.9Right to withdraw consent
Where we rely on your consent, such as for marketing emails or analytics cookies, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
9.10Right to complain
You can complain to us about how we have handled your personal data, and to the Information Commission (see Section 14). We will acknowledge any rights request within 5 working days.
10.International data transfers
This is where our main service providers store and access data:
- HubSpot: your data is stored in HubSpot's EU data centre in Germany, and HubSpot may access it from the United States and other locations.
- ScoreApp: operated by Hyper Targeted Marketing Limited in the United Kingdom. ScoreApp states that customer data is stored within the European Union.
- Google: may process analytics data in the United States.
- Microsoft: our email, files and Teams data are stored in the United Kingdom.
- Calendly: stores booking details in the United States.
- Cookiebot: stores records of your cookie choices in the European Union (Ireland), and uses a service in the United States to work out which country you are in so it can show the right cookie banner.
Where data leaves the UK, we rely on one of these safeguards:
- UK adequacy regulations, which cover the European Economic Area and some other countries
- The UK–US Data Bridge, for US companies certified to it
- The International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
You can ask us for details of the safeguard used for a particular provider.
11.Data security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including:
- HTTPS/TLS encryption on our websites and scorecard pages
- Multi-factor authentication on the accounts we use to access personal data
- Access to personal data limited to staff who need it
- Reputable service providers working under data processing agreements
- Regular review of how we handle data
If a personal data breach is likely to put your rights and freedoms at risk, we will report it to the Information Commission within 72 hours of becoming aware of it. If it is likely to pose a high risk to you, we will also tell you without undue delay.
12.Children's privacy
Our websites and scorecards are designed for adults working in or with organisations. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact office@ticcsltd.co.uk and we will delete it promptly.
Where our consultancy work involves organisations that support children and young people, any personal data about children is handled under separate, specific data processing agreements with those organisations, in line with safeguarding legislation.
13.Third-party websites and links
Our websites, scorecards and emails may link to other websites. This policy covers only our own websites and services, and we are not responsible for other sites' privacy practices. Please read their privacy policies when you visit them.
14.How to make a complaint
14.1Complaints to us
You have the right to complain to us if you are unhappy with how we have handled your personal data. You can raise it any way you like; emailing office@ticcsltd.co.uk is quickest. We will acknowledge your complaint within 5 working days, look into it, and aim to give you a full response within 10 working days. If it will take longer, we will tell you why and keep you updated.
14.2Complaints to the regulator
If you are not satisfied with our response, or believe we are not handling your data lawfully, you can complain to the UK's data protection regulator, the Information Commission (which replaced the Information Commissioner's Office on 30 September 2026).
- Website
- ico.org.uk
- Helpline
- 0303 123 1113
15.Changes to this policy
We review this policy at least once a year, and whenever our tools or practices change. When we make material changes, we will update the date at the top and, where appropriate, tell you by email or with a notice on our website. Previous versions are available on request.
16.Contact us
If you have any questions, concerns or requests about this policy or how we handle your personal data, please get in touch:
Trauma Informed Change Consultancy Services Ltd
- office@ticcsltd.co.uk
- Websites
- trauma-informed-change.co.uk and ticcsltd.co.uk
We are committed to resolving any concerns promptly and fairly.