PRIVACY & DATA PROTECTION POLICY
Calm & Connected CIC
Last updated: June 2026

We are the data controller for all personal data collected through this website and through the MM10 school wellbeing programme. We are registered with the Information Commissioner’s Office (ICO) as a data controller. [Add your ICO registration reference number here once registered.]

Who we are
Calm & Connected CIC is a Community Interest Company registered in England and Wales. Our website address is: https://calmandconnected.co.uk

What data we collect and why
When schools or individuals sign up to MM10 or contact us via this website, we may collect:

  • Name and email address (school staff and programme contacts)
  • School name and local authority
  • Anonymised pupil wellbeing check-in responses (no pupil names or personal identifiers are collected)

We collect this data to:

  • Set up and manage access to the MM10 programme
  • Send programme-related communications and updates
  • Evaluate the impact of MM10 and report to funders in anonymised, aggregated form only

How we store your data
Email addresses and contact data are stored securely within our email system, hosted on servers located within the European Union (EU). Your data benefits from the high standards of protection required under UK GDPR and EU GDPR. We do not transfer data outside the UK/EU without appropriate safeguards in place.

Our lawful basis for processing
We process personal data on the basis of legitimate interests (programme administration and evaluation) and, where applicable, consent (for marketing communications). You can withdraw consent at any time by contacting us at [email protected]

Data sharing
We do not sell or share your personal data with third parties for marketing purposes. We may share anonymised, aggregated impact data with funders or partners. Where schools sign up to MM10, a Data Processing Agreement (DPA) is in place between Calm & Connected CIC and the school, setting out each party’s responsibilities under UK GDPR.

Cookies
Our website uses cookies to improve your experience. These include:

  • Essential cookies that keep the site functioning
  • Temporary cookies set when you visit the login page (these contain no personal data and are discarded when you close your browser)
  • If you leave a comment on the site, you may opt in to saving your name and email in cookies for convenience. These last for one year.

You can control cookies through your browser settings at any time.

Comments
If you leave a comment on our website, we collect the data shown in the comment form, along with your IP address and browser information to help with spam detection. Approved comments and their metadata are retained indefinitely so we can recognise and approve follow-up comments automatically.

Embedded content
Pages on this site may include embedded content such as videos or images. Embedded content from other websites behaves as if you have visited those websites directly and may collect data or use cookies independently.

How long we keep your data
We retain contact data for as long as you are actively engaged with MM10, plus up to 2 years after your last contact, unless you ask us to delete it sooner.

Your rights
Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing
  • Withdraw consent at any time

To exercise any of these rights, contact us at: [email protected]

Complaints
If you have concerns about how we handle your data, you can contact the ICO at ico.org.uk or call 0303 123 1113.