How we handle your data

01Who we are

Human First Athlete Transitions CIC ("Human First", "we", "us", "our") is a Community Interest Company registered in England and Wales. We provide a psychological transition programme for athletes leaving elite sport.

This notice explains what personal data we collect about you, how we use it, who we share it with and the rights you have over it. It applies to visitors to humanfirst-at.com and to anyone who contacts us or applies to one of our programmes.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Human First Athlete Transitions CIC is the data controller for the personal data described in this notice.

If you have any questions, you can reach us at contact@humanfirst-at.com.

02What personal data we collect

When you browse the website

This site does not use analytics, advertising trackers, or third-party tracking cookies. We do not collect IP addresses, device identifiers or browsing behaviour for marketing purposes. See our cookie notice for more detail.

When you contact us

If you email us at contact@humanfirst-at.com, we will receive the personal data you choose to include in your message — typically your name, email address and the content of what you write.

When you apply for a programme

Applications to the Human First Retreat are submitted through a Google Form embedded on our retreat page. The form collects information you provide, which may include your name, contact details, sporting background, reasons for applying and, depending on the application, information about your wellbeing and circumstances that helps us assess suitability for the programme.

When you join a programme

If you proceed beyond application, we may collect further details needed to deliver the programme — for example dietary requirements, emergency contacts, accessibility needs and any health information you choose to disclose to our facilitators.

03Why we use your data

We use personal data to:

• Respond to enquiries and provide the information you ask for
• Assess applications and decide who is suitable for a programme
• Deliver the programme safely — including matching facilitators, planning sessions and meeting any health, dietary or accessibility needs
• Keep in touch with you about your application or place on the programme
• Improve what we do based on participant feedback
• Meet our legal, accounting and safeguarding obligations

We do not sell your data, and we do not use it for advertising or profiling.

04Our lawful basis for processing

Under UK GDPR we must have a lawful basis for using your personal data. For most of what we do, we rely on one of the following:

Consent

Where you have actively given us permission — for example by submitting an application form or emailing us. You can withdraw consent at any time.

Contract

Where processing is necessary to provide a programme you have signed up to, or to take steps at your request before entering into an agreement.

Legitimate interests

Where it is reasonably necessary for us to run and improve our work as a CIC, and your interests and rights are not overridden — for example, keeping records of past correspondence.

Legal obligation

Where we have to process data to meet a legal duty — for example, safeguarding concerns or accounting records.

For special category data (such as health or mental wellbeing information shared during application or programme delivery), we additionally rely on your explicit consent, or, where relevant, the safeguarding of an individual's vital interests.

05Who we share your data with

We share personal data only where it is necessary to do so, and only with parties bound by appropriate confidentiality and data-protection obligations. These include:

• Google (Google LLC / Google Ireland Ltd) — we use Google Forms to receive applications and Google Workspace to host email and documents. Data you submit through the application form is processed by Google on our behalf.
• Microsoft Corporation — our email (contact@humanfirst-at.com) is hosted on Microsoft 365.
• Programme facilitators, coaches and clinicians who deliver our retreats and one-to-one work, on a need-to-know basis.
• Programme partners (such as the Jacobs Futura Foundation, where they are co-delivering or funding a place) — only with your knowledge and only the minimum information required.
• Professional advisers such as accountants or legal advisers, where required.
• Regulators or authorities where we are legally required to disclose information, or where a safeguarding concern requires it.

06How long we keep your data

We keep personal data only for as long as we need it for the purposes set out above, or as long as the law requires.

• Email enquiries — typically retained for up to 2 years from your last contact, then deleted.
• Unsuccessful applications — typically retained for up to 12 months in case you re-apply, then deleted.
• Participant records — typically retained for the duration of the programme and for up to 6 years afterwards, in line with safeguarding and insurance requirements.
• Financial and accounting records — retained for 6 years as required by UK law.

If you would like your data deleted sooner, you can ask — see "Your rights" below.

07Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this notice)
• Access the personal data we hold about you
• Rectify data that is inaccurate or incomplete
• Erase your data ("right to be forgotten") in certain circumstances
• Restrict how we use your data
• Object to processing where we rely on legitimate interests
• Data portability — receive a copy of data you provided in a portable format
• Withdraw consent at any time, where consent is our lawful basis

To exercise any of these rights, email contact@humanfirst-at.com. We will respond within one month.

08How we keep your data secure

We take appropriate technical and organisational measures to protect personal data, including access controls on our email and document systems, multi-factor authentication for accounts that hold personal data, and limiting access on a need-to-know basis. The platforms we use (Google Workspace, Microsoft 365) maintain industry-standard security certifications.

No system is ever completely secure. If we ever experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and notify you where required.

09International transfers

Some of the providers we use (Google, Microsoft) are based in the United States and may transfer personal data outside the UK. Where this happens, we rely on the safeguards offered by these providers, including the UK Extension to the EU-US Data Privacy Framework and Standard Contractual Clauses, to ensure your data is protected to a standard equivalent to UK law.

10Children

Our programmes are designed for adults. We do not knowingly collect personal data from anyone under the age of 18 through this website. If you believe a child has provided us with personal data, please contact us so we can remove it.

11Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top of this page shows when it was last changed. We encourage you to review it occasionally so you stay informed about how we handle your data.

12Contact & complaints

If you have a question about how we use your data, or you want to exercise any of your rights, please email contact@humanfirst-at.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):