Privacy policy

NeurodiverCity is NeurodiverCity C.I.C., a community interest company registered in England and Wales (company number 13375108), at Initial Business Center, Wilson Business Park, Monsall Road, Manchester M40 8WN. We’re the controller of the personal data described here, and we’re registered with the Information Commissioner’s Office (ZB389983).

Questions about privacy, or a request about your data, go to dpo@neurodiver.city.

When we handle data for a business customer, such as their staff’s details on systems we support or their call recordings, we do it as their processor, under our Terms. That data is theirs, and their privacy notice applies.

• Contact and account details: name, organisation, role, email, phone number and address;
• Orders and payments: quotes, contracts, invoices and payment records;
• Messages: what you tell us in forms, emails, calls and meetings;
• Referrals: who the referral is for, who is making it and paying, and what help is needed;
• Assessments and training: information about the person’s needs, which can include health, disability or neurodivergence, education (such as an EHCP) or work (such as Access to Work), our notes, and the report;
• Business phones: the names, numbers and addresses on your lines, including the address for each number for emergency calls, and call records for billing;
• Our website: server logs of visits: IP address, browser, pages and times.

• to give you a quote, provide what you’ve asked for, and bill for it (contract);
• to keep invoices and tax records, and meet legal and regulatory duties, including Ofcom’s (legal obligation);
• to run our business, keep our systems secure and improve what we do (legitimate interests);
• to send you news, only if you’ve agreed, and you can stop at any time (consent).

We don’t sell personal data, and we don’t use it for advertising.

Assessments and training can involve health, disability and other special category data. We only collect what the assessment needs, and only with the explicit consent of the person, or of their parent or carer.

Where we have a safeguarding concern, we may share information without consent when the law allows, to protect a child or an adult at risk.

Access to referrals and assessment records is limited to the people working on them. Referrals are stored encrypted, and we keep a record of who opens them.

We assess and train young people as well as adults. For a child, we usually work with a parent or carer, and involve the young person as much as they can and want to be.

Young people who understand their rights can use them themselves, including asking to see their report.

• the referrer and the funder of an assessment, with the agreement of the person or their parent or carer, such as a school, local authority, medical professional or Access to Work;
• software makers, to issue licences in the user’s name;
• our phone platform partner, to run business phone services, and the emergency services through it;
• cloud and IT providers that host our email, files and systems;
• our payment provider, accountants and professional advisers, where they need it;
• the authorities, when the law requires it or to protect someone from harm.

Each works under a contract that protects the data. Ask dpo@neurodiver.city for the names of the companies we use.

In the UK, and with some providers in Europe or the USA. Europe (the EEA) is recognised by UK law as protecting personal data properly. When data goes to the USA, or anywhere else outside the UK and the EEA, it’s either to a company certified under the UK–US data bridge, or under safeguards UK law approves, such as the UK’s international data transfer agreement.

Call transcripts and summaries for business phones are processed and stored in the UK.

• invoices and payment records: 6 years after the year they’re from, as tax law requires;
• assessment notes and reports: 6 years after the assessment;
• contracts and customer records: while you’re a customer, and 6 years after;
• messages and enquiries that don’t go ahead: up to 1 year;
• website server logs: about 12 weeks.

You can ask for a copy of your data, ask us to correct it, delete it, limit how we use it, or send it to you in a form you can reuse. You can object to us using it for our legitimate interests, and withdraw consent at any time. We reply within a month.

If you’re unhappy with how we handle your data, please tell us first at dpo@neurodiver.city. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Our website only uses what it needs to work. See our Cookie policy.

We update this policy when how we use data changes, and tell customers about important changes.