Last updated: 11 July 2026

1. About this Privacy Notice
At Innovess, we take the privacy and security of personal information seriously. This Privacy Notice explains how we collect, use, store and protect personal information when you visit our website, contact us, work with us, attend our training or events, or take part in one of our programmes or activities.

Innovess operates through two separate legal organisations:

Innovess Ltd
ICO registration number: ZC152960
Innovess Ltd provides workplace prevention programmes, organisational consultancy, ISO 45003-aligned services, training and related workplace services.

The Innovess Group CIC
ICO registration number: ZB547334
The Innovess Group CIC supports collaborative social action, community engagement, co-design, research and the development of community-led and grant-funded initiatives.
WellBe Link operates as part of The Innovess Group CIC and has separate privacy information for its counselling services.
The organisation responsible for your personal information will depend on the service, programme or activity you engage with.
In this Privacy Notice, we use "Innovess", "we", "us" and "our" to refer to Innovess Ltd and The Innovess Group CIC collectively where the same information applies to both.
Where we work with another organisation to deliver a programme or activity, we will clarify the relevant data protection responsibilities where appropriate.
For questions about this Privacy Notice or how we use your personal information, please contact:
Joanna Buckland
Email: joanna@innovess.co.uk
Address: The Annex, Park House, 45 The Park, Yeovil, Somerset, BA22 8WB
2. The Personal Information We Collect
The information we collect depends on how you interact with us.
Identity and contact information
This may include:

• your name;

• job title or role;

• organisation;

• email address;

• telephone number;

• postal or billing address, where required.

Client and business information
Where you engage Innovess for a service or programme, we may hold information relating to:

• enquiries and correspondence;

• contracts and agreements;

• client contacts;

• project roles and responsibilities;

• meetings and programme administration;

• services purchased;

• invoices and payment records;

• feedback and service evaluation.

Training and event information
Where you attend training, workshops or events, we may collect:

• your name;

• email address;

• employer or organisation;

• the course or event attended;

• attendance and completion information;

• assessment or course progress information, where relevant;

• certificate information;

• feedback.

Where a course is delivered with an accrediting, licensing or training body, additional privacy information may apply.
Workplace programme information
As part of our workplace prevention and organisational programmes, we may facilitate:

• organisational insight surveys;

• Stress Zoning assessments;

• interviews;

• focus groups;

• workshops;

• co-design activities;

• training;

• programme evaluation.

Our organisational insight surveys are designed to collect anonymous responses wherever possible.
We do not routinely request names, employee identification numbers or other direct identifiers within anonymous survey responses.
Where demographic information is collected, we take steps to reduce the risk of individuals being identified through combinations of information or small groups.
Findings provided to client organisations are normally presented as aggregated trends, themes and organisational learning.
Interviews, focus groups and workshops
Where you take part in an interview, focus group or similar activity, we may know your identity and hold basic participation information.
Information you share will be treated confidentially and used to identify themes, patterns and organisational learning.
We will not normally attribute comments to you in client reports without your permission.
There are limited circumstances where we may need to share information, including where we reasonably believe there is a serious risk of harm, a safeguarding concern requires action, or disclosure is required or permitted by law.
Where possible and appropriate, we will discuss this with you before information is shared.
Further privacy and confidentiality information may be provided at the beginning of a particular programme or activity.
Special category information
In some circumstances, our programmes, research or activities may involve information relating to:

• physical or mental health;

• disability;

• racial or ethnic origin;

• religious or philosophical beliefs;

• sexual orientation;

• other information treated as special category personal data under UK data protection law.

We will only collect or use special category personal information where this is necessary, proportionate and lawful.
Where possible, we use anonymous or aggregated information rather than identifiable special category information.
Where identifiable special category information is processed, we will identify an appropriate lawful basis and additional legal condition for doing so.
Photographs, videos, testimonials and impact stories
We may invite people to participate in photographs, videos, testimonials, case studies or impact stories.
We will seek specific permission before using identifiable images, videos, testimonials or personal impact stories for publicity or promotional purposes.
Website and technical information
When you use our website, we may collect technical and usage information such as:

• IP address;

• browser and device information;

• website usage;

• pages visited;

• approximate location derived from technical information;

• cookie and analytics information.

Further information about cookies is available through our website cookie settings.
3. How We Collect Personal Information
We may collect personal information directly from you when you:

• contact us or complete a website form;

• enquire about or purchase a service;

• enter into a contract with us;

• book or attend training or an event;

• subscribe to our communications;

• participate in a workshop, interview or focus group;

• provide feedback;

• participate in a programme or activity;

• communicate with us by email, telephone, video call or in person.

We may also receive personal information from:

• your employer or organisation;

• a client organisation engaging us to deliver a programme;

• training or accreditation bodies;

• event and booking providers;

• partner organisations;

• professional advisers;

• publicly available professional or business sources;

• other organisations where there is an appropriate and lawful reason for information to be shared.

4. How and Why We Use Personal Information
We only use personal information where we have a lawful basis to do so.
The lawful basis will depend on why we are using the information.
Responding to enquiries and preparing services
We may use your information to respond to enquiries, discuss our services, arrange meetings and prepare proposals.
Lawful basis: taking steps at your request before entering into a contract and/or our legitimate interests in responding to business enquiries and developing our services.
Delivering services and programmes
We may use personal information to:

• manage client relationships;

• deliver workplace programmes and consultancy services;

• arrange meetings and workshops;

• communicate about programme delivery;

• manage project roles and responsibilities;

• provide agreed resources;

• administer training.

Lawful basis: performance of a contract and/or our legitimate interests in delivering and managing professional services.
Where we process personal information solely on the documented instructions of a client organisation, we may act as a data processor. In these circumstances, we process the information in accordance with our contractual obligations and applicable data protection law.
Workplace research, insight and programme evaluation
We may use information to:

• understand how work is experienced;

• identify organisational themes and patterns;

• map workplace demands and resources;

• understand barriers to participation or support;

• assess programme effectiveness;

• support organisational learning and continual improvement.

Where information is genuinely anonymised so that individuals are no longer identifiable, it is not personal data for the purposes of UK data protection law.
Where identifiable information is processed, the lawful basis will depend on the particular programme and our role in the processing.
Additional privacy information may be provided for particular programmes or activities where appropriate.
Training and event administration
We may use personal information to:

• process bookings;

• communicate joining information;

• record attendance;

• administer course completion;

• issue or facilitate certificates;

• provide course materials;

• obtain feedback;

• meet relevant training or accreditation requirements.

Lawful basis: performance of a contract, our legitimate interests and/or compliance with legal or regulatory obligations, depending on the activity.
Financial and business administration
We may process information to:

• issue and manage invoices;

• record payments;

• maintain financial records;

• manage contracts;

• obtain professional advice;

• meet tax, accounting and other legal requirements.

Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in managing our organisations.
Safeguarding and serious risk
In limited circumstances, we may process or share personal information where necessary to respond to:

• a safeguarding concern;

• a serious or immediate risk of harm;

• concerns involving an adult at risk;

• allegations involving someone working for or on behalf of Innovess;

• a legal or regulatory requirement.

Information will only be shared where necessary and proportionate and, where appropriate, on a need-to-know basis.
Marketing and communications
We may use your contact information to send newsletters, programme updates, event information, training opportunities, resources and news about our work.
Where consent is required, we will ask for it.
You can unsubscribe from marketing communications at any time by using the unsubscribe link in our emails or contacting joanna@innovess.co.uk.
Stopping marketing communications will not affect service-related communications about a programme, booking or contract.
We do not automatically transfer marketing contacts between Innovess Ltd, The Innovess Group CIC and WellBe Link.
5. Anonymous and Aggregated Information
Where possible, Innovess uses anonymous or aggregated information to support organisational learning, research, evaluation and programme development.
We may combine information to understand:

• organisational trends;

• patterns in Stress Zoning;

• workplace demands and resources;

• barriers to participation;

• programme outcomes;

• wider social impact.

We take reasonable steps to reduce the risk of individuals being identified from reported findings.
This may include:

• removing direct identifiers;

• limiting demographic breakdowns;

• combining small groups;

• reviewing free-text comments for identifying details;

• reporting themes rather than individual responses.

We do not routinely provide employers with identifiable individual survey responses.
We may use genuinely anonymised information for research, evaluation, service development, learning and impact reporting.
6. How Innovess Ltd and The Innovess Group CIC Work Together
Innovess Ltd and The Innovess Group CIC are separate legal organisations.
Innovess Ltd may direct financial contributions to The Innovess Group CIC to support social action and community activity.
Personal information about Innovess Ltd's corporate clients or their employees is not routinely transferred to The Innovess Group CIC simply because a financial contribution is made.
Where the two organisations work together on a particular programme or activity and personal information needs to be shared, we will consider the purpose of the sharing, each organisation's data protection responsibilities and the appropriate arrangements.
Where appropriate, additional privacy information will be provided.
7. Who We Share Personal Information With
We do not sell personal information.
Where necessary to operate our organisations or provide our services, we may share personal information with:

• employees and authorised team members;

• associates and contractors working with us;

• IT, cloud storage and communication providers;

• website and hosting providers;

• booking and event platforms;

• approved survey and research providers;

• accounting and payment providers;

• training and accreditation organisations;

• professional advisers, including accountants, lawyers, auditors and insurers;

• safeguarding or statutory organisations where necessary;

• regulators, courts, law enforcement or public authorities where required or permitted by law;

• client or partner organisations where there is an appropriate and lawful reason to share information.

Associates and contractors may be given access to information or shared client folders necessary to deliver agreed services.
Access is limited according to role and business need.
Where another organisation controls how it uses your personal information, its own privacy information may also apply.
8. Service Providers and Systems
We use a range of systems and service providers to manage our work.
Depending on the service or activity, these may include:

• Google Workspace, Gmail and Google Drive;

• Microsoft services and Microsoft Teams;

• Wix;

• QuickBooks;

• PayPal or Stripe;

• Mailchimp;

• Canva;

• approved survey and research platforms;

• Eventbrite;

• Ticket Tailor;

• Zoom;

• training and accreditation systems;

• Zanda for WellBe Link counselling administration;

• approved artificial intelligence tools.

Some providers process personal information on our behalf. Others may be responsible for their own use of personal information.
Where another organisation controls how it uses your information, its own privacy notice may also apply.
9. Artificial Intelligence
Innovess may use approved artificial intelligence tools to support appropriate business activities, such as drafting, structuring information, research support and developing non-identifiable materials.
We do not routinely enter identifiable employee survey responses, confidential interview or focus group disclosures, therapy information, safeguarding records or confidential coaching notes into general-purpose artificial intelligence tools.
Where the use of artificial intelligence involves personal information, we will consider the purpose, necessity, data minimisation, security and risks before using the technology.
We do not use solely automated decision-making to make significant decisions about individuals.
10. How We Protect Personal Information
We use appropriate technical and organisational measures to protect personal information from accidental loss, unauthorised access, alteration or disclosure.
Access to personal information is limited according to role and business need. People working for or on behalf of Innovess are expected to handle information confidentially and in accordance with our data protection requirements.
We have processes for responding to suspected personal data breaches and will notify the Information Commissioner's Office or affected individuals where required by law.
11. International Data Transfers
Some of our technology and service providers may process or store personal information outside the United Kingdom.
Where UK data protection rules on international transfers apply, we take steps to ensure appropriate legal safeguards are in place.
You can contact joanna@innovess.co.uk if you would like further information about international transfers relevant to your personal information.
12. How Long We Keep Personal Information
We keep personal information only for as long as it is needed for the purpose for which it was collected.
When deciding how long to retain information, we consider:

• why the information was collected;

• whether it is still needed to provide or manage a service;

• legal, accounting or regulatory requirements;

• contractual and insurance requirements;

• the sensitivity of the information;

• whether the information is needed to establish, exercise or defend legal claims.

Information that is no longer required will be securely deleted, destroyed or anonymised, where appropriate.
Some records must be retained for specific periods. For example, we retain relevant financial and accounting records in line with applicable legal requirements. Company accounting records generally need to be retained for six years from the end of the relevant financial year under current government guidance.
WellBe Link counselling records are normally retained for seven years after counselling ends, in line with the separate WellBe Link privacy notice and applicable professional and insurance requirements.
Genuinely anonymised information may be retained for research, evaluation, learning, benchmarking, service development and impact reporting because it no longer identifies an individual.
We review the information we hold and our retention arrangements as our services and programmes develop.
13. Your Data Protection Rights
Depending on the circumstances, you may have the right to:

• Access — ask for a copy of personal information we hold about you.

• Correction — ask us to correct inaccurate or incomplete information.

• Erasure — ask us to delete personal information in certain circumstances.

• Restriction — ask us to limit how we use your information in certain circumstances.

• Object — object to certain uses of your personal information, including direct marketing.

• Data portability — receive certain information you have provided to us in a structured, commonly used and machine-readable format where the legal conditions apply.

• Withdraw consent — where we rely on consent, withdraw it at any time.

• Rights relating to automated decision-making — have protections in relation to certain significant decisions made solely by automated means.

These rights are not absolute and may depend on the circumstances and our lawful basis for using your information.
To exercise your rights, contact joanna@innovess.co.uk.
We may need to ask for information to confirm your identity before responding.
You will not normally have to pay a fee. However, data protection law allows a reasonable fee to be charged or a request to be refused in limited circumstances.
We will respond to valid requests within the timescales required by data protection law.
14. Marketing Preferences
You can ask us to stop sending marketing communications at any time.
You can use the unsubscribe link in a marketing email or contact joanna@innovess.co.uk.
Where you opt out, we may retain limited information so that we can record and respect your preference.
Opting out of marketing does not prevent us from contacting you about an existing contract, programme, booking or other service-related matter.
15. Cookies and Third-Party Links
Our website may use cookies and similar technologies to support website functionality, understand how the website is used and improve the visitor experience.
Where required, we will ask for your consent before using non-essential cookies.
You can manage your preferences through our website cookie settings and browser settings.
Our website may also contain links to websites or services operated by other organisations. We do not control how those organisations use personal information and encourage you to review their privacy information.
16. Children
The Innovess website and our current workplace services are not directed at children under the age of 18.
We do not knowingly collect children's personal information through the Innovess website for the purpose of providing our current workplace programmes.
If our services or community programmes change in future to involve children or young people, we will review our data protection arrangements and provide appropriate privacy information before the relevant activity begins.
17. Data Protection Complaints
If you have a concern or complaint about how Innovess Ltd or The Innovess Group CIC has used your personal information, please contact:
Joanna Buckland
Email: joanna@innovess.co.uk
Address: The Annex, Park House, 45 The Park, Yeovil, Somerset, BA22 8WB
We accept data protection complaints however they are received.
We will acknowledge receipt of a data protection complaint within 30 calendar days and investigate the matter appropriately. We will communicate the outcome as soon as reasonably possible and, where an investigation remains ongoing, provide appropriate information about its progress.
You also have the right to complain to the Information Commissioner's Office.
Make a complaint to the Information Commissioner's Office
The Information Commissioner's Office can be contacted by telephone on 0303 123 1113 or by post at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
We welcome the opportunity to consider your concern directly, but you are entitled to contact the Information Commissioner's Office.
18. Changes to this Privacy Notice
We may update this Privacy Notice as our services, programmes, systems or legal obligations change.
We will keep this notice under review and update the Last updated date when changes are made.
Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals where appropriate.
Please let us know if your personal information changes during your relationship with us so that we can keep our records accurate and up to date.
19. Contact Us
If you have questions about this Privacy Notice, would like to exercise a data protection right or have concerns about how your personal information is used, please contact:
Joanna Buckland
Email: joanna@innovess.co.uk
Address: The Annex, Park House, 45 The Park, Yeovil, Somerset, BA22 8WB
When contacting us, please let us know whether your enquiry relates to Innovess Ltd, The Innovess Group CIC or WellBe Link, if known. This will help us direct your request appropriately.