Privacy Policy

1. Who we are

MENd Together (MENDTOGETHER CIC) is a community interest company based in Canterbury, Kent, UK, providing peer support groups, online programmes and community wellbeing services for men. In this policy "we", "us" and "our" mean MENd Together CIC, the data controller for personal information collected through this site and our member app.

2. What we collect

Depending on how you use MENd Together, we may collect:

• Name and email when you sign up, book a session, donate, or send a message
• Optional phone number on referral and contact forms
• Payment information processed securely by Stripe — we never see or store full card details
• Member account data (login, membership tier, session attendance) if you join Recovery Hub
• Anonymous, aggregated usage analytics if you've opted in via the cookie banner
• Anything you choose to share with us in messages, sessions, journal entries or assessments

3. Lawful bases (UK GDPR)

• Contract — to deliver the membership, sessions or programme you've signed up for.
• Consent — for marketing emails, optional analytics, and any sensitive information you voluntarily share.
• Legitimate interest — to keep our community safe, prevent abuse, and improve the service.
• Legal obligation — safeguarding, tax, accounting and statutory record keeping.

4. How we use your information

• Respond to enquiries, referrals and booking requests
• Provide the membership, sessions or programmes you've signed up for
• Process payments and donations through Stripe
• Send service emails (receipts, session reminders, safeguarding notices)
• Send optional newsletters and programme updates — only with your consent
• Improve the site and member experience using aggregated, anonymous analytics

5. Confidentiality and safeguarding

What's shared in our groups and sessions stays in the room. Facilitators are bound by confidentiality and don't repeat what's said outside the space.

The only exception is safeguarding. If we believe a man is at immediate risk of serious harm to himself or others, or that a child or vulnerable adult is at risk, we may need to share limited, relevant information with emergency services or the appropriate authority. We'll tell you wherever it's safe to do so. See our safeguarding page for full detail.

6. How we keep it safe

Personal data is encrypted in transit (HTTPS/TLS) and at rest. Access is restricted to the small team who need it to run the service. Payments are processed by Stripe under PCI-DSS. We review our security setup regularly and patch promptly.

7. Who we share it with

We don't sell, trade or rent your data. We use a small set of trusted processors:

• Stripe — payment processing (donations, membership, sessions)
• Resend / email provider — transactional and consented marketing email
• Supabase — secure database and authentication for our member app
• Hosting / CDN — to serve this website

We may also share information where required by law, court order, or to meet a safeguarding duty.

8. How long we keep it

• Account and membership data — for as long as your account is active, plus up to 12 months after closure.
• Booking and donation records — 7 years for accounting and tax obligations.
• Safeguarding records — retained in line with our safeguarding policy.
• Marketing consent records — until you withdraw consent or close your account.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion ("right to be forgotten"), within our legal obligations
• Restrict or object to processing
• Receive a portable copy of data you provided
• Withdraw consent at any time

Email info@mendtogether.org with the subject "Data request". We respond within 30 days.

10. Cookies and tracking

We keep tracking minimal and ask before turning on optional analytics. See our Cookie & Tracking Policy for the full list and how to change your mind.

11. Children

MENd Together is for adult men (18+). We don't knowingly collect personal information from anyone under 18. If you believe a minor has shared information with us, please email us and we'll remove it.

12. International transfers

Some of our processors (e.g. Stripe, Supabase) may process data outside the UK. Where they do, we rely on UK-approved transfer mechanisms (UK IDTA, adequacy decisions, or Standard Contractual Clauses) to ensure equivalent protection.

13. Complaints

We'd rather you tell us first — email info@mendtogether.org and we'll do our best to put it right. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

14. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page and, where appropriate, by email. The date at the top reflects the most recent update.

15. Contact

Questions about this policy or your data: info@mendtogether.org.