Last updated: 14 October 2026
This Privacy Policy explains how Homeless Evolution collects and uses personal information through this website, initial supported accommodation enquiries and, where applicable, later referrals or support arrangements. We aim to protect the privacy, dignity and confidentiality of people experiencing homelessness or housing insecurity, referrers and residents.
1. Who is responsible for your information?
Data controller: Homeless Evolution, a not-for-profit supported accommodation organisation based in Cardiff, Wales. Homeless Evolution determines how and why personal information is used for its own accommodation and support services.
Data protection and privacy enquiries: help@homelessevolution.com. You can also use this address to request an appropriate postal contact address or a copy of this notice in another format.
Information Commissioner’s Office registration: ZB855521. Other organisations involved in a referral or in service delivery may be separate data controllers for their own records and activities.
2. Information collected through the website enquiry form
Our initial referral enquiry form is designed to collect only enough information to contact you and understand the nature of your request. It asks for:
- Your name and email address.
- Your telephone number, if you choose to provide one.
- Whether you are contacting us as an individual, charity, local authority, NHS service, probation service or other referrer.
- An optional brief message about the reason for the enquiry.
- An acknowledgement that the form is for initial enquiries and must not be used for sensitive personal information.
Do not include medical diagnoses, care plans, mental health or addiction records, safeguarding reports, criminal histories, identity documents, benefit records or detailed third-party information in this public form or an ordinary email. If we need any of this information to assess suitability, we will discuss the need for it and arrange an appropriate separate and secure method of collection.
If you are making an enquiry on behalf of someone else, share only your own contact information and minimal non-sensitive details at first. Please do not assume that submitting the form authorises disclosure of another person’s confidential information.
3. Why we use personal information and our lawful bases
We use personal information only where we have a lawful basis under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. Different activities may use different lawful bases:
- Responding to an initial enquiry: our legitimate interests (UK GDPR Article 6(1)(f)) in responding to referrals and operating our supported accommodation service, balanced against the rights of those contacting us.
- Considering accommodation and taking requested steps before an agreement: Article 6(1)(b), where processing is necessary to take steps at the request of the person concerned before entering into a contract; otherwise an appropriate lawful basis such as legitimate interests may apply.
- Meeting legal, accounting, regulatory, housing or safeguarding obligations: Article 6(1)(c) where a specific legal obligation applies. Other lawful bases may be relevant to particular statutory or emergency situations and will be assessed when required.
- Keeping necessary records and protecting service delivery: legitimate interests, relevant contractual requirements or legal obligations, depending on the particular record and purpose.
Where we rely on legitimate interests, these include responding to appropriate enquiries, providing a safe and properly managed housing service, maintaining accurate service records and protecting residents, staff and others. We consider necessity and individuals’ rights before relying on this basis. The enquiry form’s acknowledgement is not used as blanket consent to process sensitive information or to send marketing messages.
4. Sensitive information and later assessments
Supported accommodation may involve additional information about support needs, health, disability, housing history, risk, safeguarding, benefits or personal circumstances. We do not seek this information through our public initial enquiry form.
If an assessment or placement progresses, we explain the information required, why it is needed, who may receive it and how it will be collected and held. We aim to obtain it directly from the individual or from an appropriately authorised professional, and use a separate secure process rather than the general website contact form.
Special category information, such as health information, is processed only if a UK GDPR Article 6 lawful basis and an appropriate Article 9 condition, together with any required Data Protection Act 2018 safeguards, apply. Information about criminal convictions or offences is subject to additional legal restrictions. The applicable conditions and safeguards depend on the individual purpose; an initial enquiry does not itself establish them.
Records created for residents and ongoing support are handled separately from the website’s initial enquiry workflow and are subject to appropriate access restrictions and retention decisions.
5. How website enquiries are processed and stored
The Homeless Evolution referral form uses a WordPress-based form handler to send the information provided to an authorised Homeless Evolution email inbox. The custom form does not intentionally create a separate searchable database of enquiry answers in WordPress. Copies of the enquiry may remain in authorised email accounts, backups, or relevant correspondence and referral records.
The form uses a short-lived, pseudonymised technical value derived from the visitor’s IP address to limit repeated submissions and deter abuse; the custom form does not need to include an ordinary readable IP address in the enquiry email. Website hosting and security services may separately process technical details such as IP addresses and request logs for operation, security and troubleshooting.
We take proportionate technical and organisational steps to protect data, including limiting access to authorised personnel, handling personal information only for legitimate purposes and selecting methods appropriate to the sensitivity of the information. No online service is entirely risk-free, so especially sensitive records should not be sent through an open website form.
6. Who information may be shared with
We do not sell enquiry or resident information. Where sharing is lawful, relevant, necessary and proportionate, information may be shared with:
- Authorised Homeless Evolution directors, staff or persons supporting the service.
- Organisations assisting with website hosting, business email, security, data storage or technical administration, acting under appropriate arrangements.
- Referring professionals, local authorities, relevant housing or benefit services, NHS or specialist support teams, probation services and community organisations, where the sharing is appropriate to a referral, agreed support or a legal duty.
- Professional advisers, insurers, regulators, courts or emergency/safeguarding services where a legal requirement or other valid basis applies.
Sharing with partner services is not automatic. We consider the purpose, minimum information needed, confidentiality, the person’s circumstances and the applicable legal basis. We seek to involve individuals and explain disclosures wherever appropriate and safe to do so.
7. International transfers and service providers
Our website and email services may rely on technology suppliers whose systems or support operations are outside the United Kingdom. Where a restricted international transfer takes place, we assess the applicable UK legal requirements and the safeguards provided by the supplier, such as relevant adequacy regulations or recognised contractual protections. You may contact us for further information about the providers and safeguards relevant to your records.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, regulatory, safeguarding and legitimate record-keeping requirements.
- Initial enquiries that do not progress: reviewed once the enquiry is closed and any reasonable follow-up, complaint or relevant legal need has ended, with information deleted or securely disposed of when no longer required.
- Enquiries that progress to assessment or accommodation: relevant information may become part of a separate referral or resident record and is reviewed under the retention requirements for those records.
- Resident and support records: kept according to the applicable purpose, legal obligations, safeguarding responsibilities and documented organisational retention arrangements; different record types may have different periods.
- Technical anti-spam controls: the form’s rate-limiting value is normally held for approximately one hour; provider logs and backups may have their own retention periods.
Where information must be retained for a legal claim, an ongoing dispute, safeguarding matter or statutory obligation, we may hold the minimum necessary information for longer. You can ask us how the retention criteria apply to your particular records.
9. Your data protection rights
Depending on the type of information and the lawful basis being used, you may have rights to be informed, request access, correct inaccurate information, request erasure, restrict processing, object to processing and receive or transfer certain information. You also have rights concerning qualifying solely automated decisions. Some rights are subject to legal limitations.
To exercise a right, raise a privacy concern or make a data protection complaint, email help@homelessevolution.com with sufficient details for us to respond. We may need to verify your identity and, where you act for another person, your authority. We will respond within applicable legal timescales, usually within one calendar month for a rights request, subject to lawful extensions or exceptions.
You may also raise a concern with the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint/. We would welcome the chance to investigate a concern directly first, but you do not have to contact us before approaching the ICO.
10. Cookies, security and website analytics
Our website uses WordPress and supporting technology that may use essential cookies or similar technologies to operate, protect and administer the website. We use a consent-management tool to manage choices about non-essential website technologies. When analytics are enabled, visitors should be able to accept or reject analytics cookies without losing access to our referral form or services.
Optional Google Analytics 4: If activated, we use it to understand which pages are visited and whether visitors successfully reach our initial referral enquiry confirmation. This may involve cookies, pseudonymous online identifiers, approximate location and basic technical details. We will not intentionally send names, email addresses, phone numbers, referral messages, diagnoses, safeguarding information or other sensitive form details to Google Analytics. We will not use this data for advertising or automated decisions about referrals. Google may process data internationally under its applicable safeguards.
Your choice: Non-essential analytics should remain off unless you explicitly consent. You may decline analytics while continuing to use our site and contact form. Once the consent banner is configured, a cookie preferences control will provide a way to review or withdraw your choice. We will update our disclosures if we change the technologies used or how they process information.
11. Changes to this notice
We may update this policy when our services, suppliers, lawful processing activities or legal requirements change. We will update the date shown at the top and provide additional privacy information where needed, particularly before collecting new categories of sensitive information.
For initial Cardiff supported accommodation enquiries: return to the referral form or email help@homelessevolution.com.