Privacy Policy

Invisible Visible CIC, which runs the project I would be here if I could, is committed to protecting and respecting your privacy.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and the choices and rights you have. We aim to use clear, straightforward language so you can understand how your information is handled.

If you have any questions about this policy or how we use your information, please contact us using the details below.

Who is responsible for your information?

Invisible Visible CIC (company number 15705730) is the data controller responsible for deciding how your personal information is collected and used.

ICO registration number: ZB792635

The person responsible for managing data protection enquiries for this project is:
Alison Larkman
Invisible Visible CIC
11 Agate St, Bristol BS3 3AQ, UK
Email: [email protected]

If you have any questions about this Privacy Policy or how your personal information is used, please get in touch.

Definitions

Participants – People who have shared an audio message with the project.

Visitors – People who visit our website and may leave comments, replies or digital postcards.

Digital postcard senders – People who send a digital postcard in response to a participant’s message.

Personal data – Information that can identify you, such as your name, email address, telephone number, IP address or browser information.

Special category personal data – Information about your health, ethnicity, religion, political views, trade union membership, sexual orientation or other information given extra protection under UK data protection law.

Processing – Any activity carried out using personal information, including collecting, storing, reviewing, publishing, sharing or deleting it.

1. Information we collect

We may collect the following information.

Participants

• Name
• Preferred public name
• Email address
• IP address
• Postal address (only where a participant’s message has been played in the Mirrorbox installation). Postal addresses are used for sending physical postcards from visitors and will be deleted once they are no longer needed.
• Audio message
• Transcript of your message
• Photographs or images you provide
• Any other information you choose to share

Visitors

• Name (if provided)
• Donation information (payments are processed securely by Zeffy)
• Comments or replies
• IP address
• Browser and device information

Digital postcard senders

• Browser and device information
• Name (if provided)
• Email address 
• Your digital postcard message
• Whether you agree for your postcard to be published
• Whether you would like your name shown publicly or your postcard published anonymously
• IP address

2. How we use your information

We use your information to:

• run and maintain the website;
• deliver the project;
• report to funders to provide evidence of project delivery where required. Where possible, we will use anonymised or aggregated information;
• publish participant messages where permission has been given;
• receive, review and moderate digital postcards;
• notify participants when they receive a digital postcard, where they have agreed to this;
• publish digital postcards where the sender has given permission;
• respond to enquiries;
• manage donations;
• improve the website using anonymous website statistics;
• prevent spam, fraud and misuse;
• keep the website secure; and
• meet our legal responsibilities.

If we would like to use your information for another purpose connected with the project, we will always ask your permission first.

2.1 Mailing list

We use Jetpack to manage our mailing list.

You will only receive emails from us if you have chosen to join the mailing list. We use a double opt-in process. This means that after signing up you must also click the confirmation link in the email we send you.

You can unsubscribe at any time using the link in any email we send.

2.2 Public information

Some information you provide may be made public if you have given permission. Once information has been published online or shared through public channels, we cannot guarantee that copies made by others can be removed. This includes material displayed at exhibitions, printed publications, archived project materials or shared through third-party platforms.

Participants

The following may be published on our website, social media, exhibitions, publications and other project activities:

• The public name you have given us permission to use
• your photograph;
• your audio recording; and
• a written transcript of your message.

Website Visitors

If you leave a comment or reply, your comment, your name (if provided) and related information may be visible publicly depending on the platform settings.

Digital postcard senders

If you agree, your postcard may be published alongside the participant’s message.

You can choose whether:

• your name is shown publicly; or
• your postcard is published anonymously.

2.3 Digital postcards

Participants can choose whether to receive digital postcards.

If a participant does not enable digital postcards, visitors will not see the option to send one next to their message.

Every postcard is reviewed by the project team before it is shared or published. We remove spam and may choose not to publish or send messages that are abusive, offensive, unlawful or inappropriate.

If a participant has agreed to digital postcards, we will let them know when they receive one.

Digital postcards are messages of support. Participants and postcard senders cannot contact each other through the project, and personal contact details are never shared.

If the project publishes a postcard that the Participant would prefer to have removed, they can contact us and ask us to remove it.

Digital postcard senders can withdraw permission for publication at any time. We will remove the postcard from public view as soon as reasonably possible, and within one month.

3. Why we are allowed to use your information

UK data protection law requires us to have a legal reason for using your information.

Depending on what you do with the project, we use one or more of the following:

• Consent – for publishing participant messages, photographs and digital postcards, sending newsletters, and notifying participants about postcards.
• Contract – where we need to provide a service you have requested, such as processing a donation.
• Legal obligation – where we must keep records or comply with the law.
• Legitimate interests – for keeping our website secure, improving our services and preventing misuse, while respecting your rights.

We do not ask people to provide special category personal data. However, participants may choose to share special category information (for example information about health, disability, religion or other sensitive experiences) in their audio messages. Where this happens, we process this information only with their explicit consent and where necessary for the purposes of the project.

4. Sharing your information

We do not sell your personal information.

We only share personal information where:

• you have given permission;
• the law requires us to;
• it is necessary to protect someone’s safety; or
• it is necessary to provide the services that support the project.

Participants’ and digital postcard senders’ personal contact details are never shared with each other.

5. Third-party services

We use trusted third-party services to help us run the project.

These include:

• Google Analytics: Website usage statistics
• Google ReCaptcha: Spam protection
• Mapbox: Displaying maps
• Zeffy: Processing donations

These organisations only receive the information they need to provide their service.

Some of these services may store or process information outside the UK. Where this happens, we make sure appropriate safeguards are in place to protect your personal information in line with UK data protection law.

6. Keeping your information safe

We take appropriate technical and organisational measures to keep your information secure and prevent unauthorised access, loss or misuse.

Messages, recordings and digital postcards can only be accessed by authorised members of the project team who need access for moderation, administration or delivery of the project.

If you make a donation, your payment details are handled securely by Zeffy. We never see or store your full payment card details.

7. How long we keep your information

We only keep personal information for as long as we need it.

We regularly review the information we hold and delete or anonymise information when it is no longer needed.

Our current retention periods are:

• Participant messages and related project records: retained for the lifetime of the project and archive period, unless consent is withdrawn or deletion is requested where applicable. When the projet ends, we will review whether information should be deleted, anonymised or retained as part of an archive.
• Consent records: retained for up to 5 years after consent is withdrawn to demonstrate how consent was obtained.
• Financial records: retained for 6 years to meet legal accounting requirements.
• Mailing list information: retained until you unsubscribe and deleted within one month.

8. Your rights

You have the right to:

• know what information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your information where appropriate;
• ask us to limit how we use your information;
• object to certain types of processing;
• receive a copy of your information in a usable format where appropriate; and
• withdraw your consent at any time where we rely on consent.

To exercise any of these rights, please contact us.

We will normally respond within one month.

You can also complain to the ICO (Information Commissioner’s Office)  if you believe we have not handled your information properly.

ICO website: https://ico.org.uk

ICO complaint page: https://ico.org.uk/make-a-complaint

9. Withdrawing consent

Participants can ask us at any time to remove their published message or stop receiving digital postcards.

Digital postcard senders can also withdraw permission for their postcard to be published.

Removing content from the website will not affect any processing that took place before consent was withdrawn. We will remove published material as soon as reasonably possible after receiving your request.

10. Cookies

We use cookies to help our website work properly and to understand how people use it. We use a cookie banner that allows you to accept or reject non-essential cookies.

Some cookies are essential for the website to work. Others, such as analytics cookies, help us improve the website. Where required, we will ask for your consent before using non-essential cookies.

11. Children

Our website is intended for a general audience.

If anyone under the age of 18 wishes to participate in the project, we will ask for permission from a parent, guardian or other appropriate adult where needed. We do not knowingly collect information from children under 16 without appropriate consent from a parent, guardian or responsible adult.

12. Sensitive content and participant support

We recognise that messages shared online through this project relate to difficult, personal and sensitive experiences. We provide content notices on the message library and map to help visitors decide what they feel comfortable viewing. Participants can contact us at any time if they have questions or concerns about how their information is used, displayed or shared.

13. Complaints

We hope you will contact us first if you have any concerns about how we use your personal information so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection.

14. Changes to this privacy policy

We may update this Privacy Policy from time to time.

When we make changes, we will publish the updated version on this page and change the date below.

Last reviewed: 7 July 2026
Version: 2.0