Controller, scope and contact
Phoenix Utd CIC is an active Community Interest Company, company number 11027177. Its registered office is Office 1 Izabella House, 24–26 Regent Place, Birmingham, B1 3NJ. References to “PUCIC”, “we”, “us” and “our” in these documents mean Phoenix Utd CIC.
PUCIC is the controller for personal data handled through its public website and controlled service routes. Contact DPO@pucic.co.uk for privacy questions, requests or concerns. This policy is read alongside the newsletter privacy notice and any service-specific notice supplied when a live secure service opens.
Information we handle and why
Depending on the route, PUCIC may handle contact details and enquiry content, newsletter email addresses, accessibility feedback, website analytics and, through its controlled referral workflow, referral, consent and safeguarding information. The initial referral workflow does not accept attachments. PUCIC uses information to respond to requests, operate services, protect people, meet legal obligations, improve the website and communicate where a person has opted in.
Lawful bases and special-category information
PUCIC will identify and document the appropriate lawful basis for each processing activity. Where consent is used, it is specific, clear and capable of withdrawal. Secure referrals may involve sensitive or safeguarding information; PUCIC will not enable public referral collection until the relevant policy, consent, security and staff-access controls are complete.
Retention and deletion
| Activity | Approved retention approach |
|---|---|
| Ordinary contact enquiries | Up to 12 months after the last meaningful contact, unless an individual becomes a learner, a legal obligation applies or an active dispute justifies a documented extension. |
| Newsletter | While subscription remains active; a minimal suppression record is retained for 24 months after opt-out to honour the choice. |
| Secure referrals | 24 months before deletion. The initial attachment-free workflow deletes encrypted referral records and related audit events; an unexpected historic attachment record is stopped for documented manual physical-deletion review. |
Processors, sharing and transfers
| Provider | Role in the PUCIC service | Current or planned use |
|---|---|---|
| Manus | Website hosting, application infrastructure and analytics | Website operation and aggregated site measurement |
| Microsoft 365 | Organisational email | Microsoft 365 is not used for the initial attachment-free referral workflow. |
| Mailchimp | Newsletter processor | Email-only double-opt-in newsletter when activated |
| Google Maps | Visitor-requested map service | Map panel is loaded only after a visitor requests it |
| Cloudflare | Web-security and delivery services | Where enabled for PUCIC web delivery |
PUCIC does not sell personal information. It shares information only where necessary for the stated purpose, where a person has agreed, where a safeguarding or legal duty requires it, or where a provider acts under appropriate contractual and security controls. International transfer safeguards must be reviewed before personal data is transferred outside the UK or relevant protected territory.
Your rights and concerns
Subject to applicable law, individuals may request access, correction, erasure, restriction, objection or portability, and may withdraw consent where consent is the basis. Contact DPO@pucic.co.uk. You may also raise a concern with the UK Information Commissioner’s Office. PUCIC will review this policy every 12 months or sooner where UK law requires.