Privacy notice

What we collect when you get in touch, why we collect it, and what you can ask us to do with it, in plain English.

Who we are

Difability is an initiative of IT’S POSSIBLE NOW COMMUNITY INTEREST COMPANY (Company No. 16430786). It is a UK company. In this notice, “we” means that company. You can reach us at ashraf@ipncic.com or on +44 7955 356126.

What we collect

When you get in touch, what you send us through the Get started form:

your name
your email address or your phone number, whichever you choose
what you would like to do
whether you are filling in the form for someone else
anything you choose to write in the message box

Our website host records technical information, such as your IP address, as part of serving the page and protecting the form from automated abuse. We do not use analytics or advertising cookies, and we do not track you across other websites.

When your organisation joins Difability or applies for recognition:

the name and work email address of each person with an account, and a password stored only in a form that cannot be turned back into the password
the organisation’s name, website, register number and the register’s public details
the name, role and email address of the person responsible for the Commitment
answers to the assessment questions, the evidence files uploaded with them, and messages with Difability staff
a record of each step taken on an application and who took it, so that every decision can be checked

The public register

Anyone can check a Difability record by its number. A record shows the organisation’s name, its level, the record number, its dates and whether it is active. It never shows scores, answers, evidence or the names of the people who applied. An organisation can also choose to appear in the public directory, and can leave it at any time.

Signing in sets cookies that keep you signed in. One more cookie, holding only the value 1 and removed when you close your browser, lets every page show a link to your account. None of these cookies is used for analytics or advertising.

Nominations

Anyone can nominate an organisation or a person to Difability, without an account. When you send a nomination, we collect:

your name and email address
details of the organisation or person you nominate. For a named person, this can include their name, role and location, and their contact details if you give them
the examples you give of what they have done

A nomination can be about someone who did not give us their details themselves. We do not ask for health information about anyone, and we ask you not to include it.

Our lawful basis is legitimate interest: considering the nomination and, where it fits, contacting the organisation or person nominated. Nominations are seen only by the Difability staff who review them. If we contact a person you nominated, we tell them where their details came from.

We delete the personal details in a nomination 12 months after the nomination is closed. We keep its reference number and outcome.

Concerns

Anyone can raise a concern with Difability, without an account: about a record on the register, about a Difability claim seen somewhere else, or about how we handled something. When you raise one, we collect:

your name and email address
the record number or organisation it is about, and where you saw the claim, if you tell us
what you tell us about the concern

We do not ask for health information about anyone, and we ask you not to include it. Our lawful basis is legitimate interest: keeping the public register accurate and answering complaints about our service. Concerns are seen only by the Difability staff who look into them. We write to you when we have looked into it, and never repeat what you wrote in an email.

We delete your name, email address and what you told us 12 months after the concern is closed. We keep its reference number, what it was about and what we found.

The Difability Community

The Community is for people aged 18 or over and for organisations whose identity we have checked. When you join as a person, we collect:

your email address and a password, to sign you in
the display name you choose, whether you join as an individual or as a family member or carer, and that you confirmed you are 18 or over and accepted the rules
if you choose: your area, a short note about yourself, and the areas and topics you follow
what you post and reply, images you add with their descriptions, the reports you make and the members you block
your settings, such as text size and which emails you want

We never ask for disability or health information, your address, town or date of birth. You may write about yourself, but we ask you never to post anyone’s address, phone number or health information. We remove location and camera details from every image before anyone sees it.

Your display name, the date you joined and any Community Ally or Difability Dot mark are seen by signed-in members; your area only if you choose to show it. Members’ posts and replies are seen only by signed-in members and are never shown to search engines. Official announcements and the events and opportunities of organisations we have checked are public. Your email address is seen only by you and Difability staff. The reports you make and the members you block are seen only by you and our moderators, never by the other member.

Our lawful bases are: contract, to run your account and let you take part; legitimate interest, to moderate the Community, prevent fraud and keep people safe; consent, for the weekly email and anything you choose to show; and legal obligation, when the law requires us to give information, for example to a court. Where we believe someone is at risk of harm, a trained safeguarding lead may share information with the emergency services, a local authority or the police, only as far as needed to protect them (Data Protection Act 2018, Schedule 1, paragraph 18). Every such share is recorded.

You can download your profile, posts and replies from your Community settings, and close your account at any time. You can reopen it for 30 days; after that it is deleted.

Community Ally

When we invite you to become a Community Ally, we hold your name, the kind of Ally (a business, community organisation, individual or local public figure), your town, your email address if we have it, and the note we wrote to you. Your invitation code is stored only in a form that cannot be turned back into the code. When you apply, we also collect why you want to be an Ally, the commitments you choose and how you will keep them, whether you want to be listed in the directory and, for a window sticker, your premises address.

Your Ally record shows your name, kind, town and commitments to anyone who checks its number. The directory lists you only if you agree. Our lawful bases are contract, to run the scheme with you, and consent, for the directory listing.

The Difability Dot

When someone is put forward for the Difability Dot, we hold their name, how to contact them, their town, what they did, the evidence and, where there is one, a referee’s name and email address. We consider nobody without their agreement, or a parent’s or guardian’s agreement for someone under 18. If they say no, nothing is published.

A recipient chooses how their story is shown: their full name, or their first name and town, with or without a photo, or with no publicity at all. Under 18, only a first name and town are shown, with no photo. Our lawful basis is consent.

Live conversation

When live conversation is open, area rooms and conversations between two members who have both agreed to talk are saved so they can be shown again and moderated. Moderators see a message in a conversation only when it is reported or held by our automatic checks. Our lawful bases are contract, to let you take part, and legitimate interest, to moderate. Showing that you are online is off unless you turn it on, and it is never shown to people you have blocked. If you turn on notifications on your device, we keep the address your browser gives us for them, and delete it when you turn them off or your browser stops accepting them. Both are based on your consent, and you can turn either off at any time in your Community settings.

Awards sent by post

For a printed certificate or a trophy sent by post, we collect the name and delivery address the organisation gives us. We use them only to send the award, and delete them 12 months after it is delivered.

Health information

We do not ask for or store a diagnosis, a condition, or any medical or health information. No form and no assessment question asks for it. Evidence should show what an organisation does, never who has a condition. If a message or an evidence file contains health information about anyone, tell us and we delete it; our assessors delete it too when they find it.

Why we collect it

To reply to you and help with what you asked about. If you give us your email address, we also send you one email to confirm we have your message. We do not sell your details, we do not add you to a marketing list, and we do not publish a list of the people who contact us.

Our lawful basis

For the Get started form, consent. You tick a box before the form will send, and that consent is the basis on which we hold and use what you sent. You can withdraw it at any time. Withdrawing it does not affect anything we did while it was in place.

For accounts, membership, applications and awards sent by post, our legitimate interest in running the scheme your organisation asked to join, and in being able to show that every decision was made fairly. For the public register, the same interest, and the interest of anyone who wants to check a Difability claim before relying on it.

How long we keep it

What you send through the Get started form: for as long as we need it to help with what you asked about, and no longer than two years from the day you send the form. After that we delete it. If you ask us to delete it sooner, we do that instead.

An account whose email address is never confirmed: 7 days.
An application that is started and left untouched: 12 months, with a warning first.
Applications and evidence: 6 years after the last outcome, then deleted.
The record of who did what: as long as the decision it supports. People appear in it by a reference, not by name, so when we delete someone’s details the record no longer points to them.
A public record stays on the register with its final status, so that a certificate can always be checked.
Nominations: the personal details, 12 months after the nomination is closed. The reference number and outcome are kept.
Concerns: your name, email address and what you told us, 12 months after the concern is closed. The reference number, subject and outcome are kept.
A name and delivery address for an award sent by post: 12 months after the award is delivered.
A Community account and profile: 30 days after it is closed. Until then it can be reopened.
Community posts and replies: with the account; ended events and opportunities 12 months after they end. A post you delete goes at once, unless a report or a moderator’s decision refers to it: then moderators keep a copy for 12 months.
Removed posts and moderation decisions: 12 months after the decision.
Reports: the details you gave, 12 months after the report is closed. The reference and outcome are kept.
Safeguarding cases: 6 years after the case is closed.
Community Ally invitations never used: the invitee’s details, 30 days after the invitation expires. Applications: 12 months after the decision; the Ally record and number stay.
Difability Dot candidates who are not chosen, decline, or do not reply: 12 months after their last round.
The record of each email we send (address, subject, and whether it was delivered): 13 months. If an email could not be delivered, its content is kept for up to 14 days so it can be sent again, then removed. A sign-in code is removed at once.
Live conversation in rooms: 12 months. Conversations between members: with the account. A message that a report or a moderator’s decision refers to is kept for moderators until it is 12 months old.

Who sees it

The people at that company who work on Difability. We use ordinary website hosting and email services to receive and store what you send, and those providers can technically access it in the course of running their service. We will not pass your details to an employer or any other organisation without asking you first and getting your answer.

Applications and evidence are seen only by the Difability staff working on that case: the assessor, the Coordinator, the person who decides, and, if there is an appeal, the person who reviews it. Evidence files are kept in private file storage that only the platform can open; each download link it makes works for five minutes. Account and application emails go through the same email service.

We send emails about signing in and your account; your organisation’s membership, applications and decisions; messages from Difability staff; reminders before a date that affects you; nominations, invitations and the Difability Dot, when they concern you; and the Community, about your own posts and account and the emails you choose in your settings. A Community Ally invitation is followed by at most one reminder. For each email we keep a record of the address, the subject and whether it was delivered.

Your rights

Under UK data protection law you can ask us to:

tell you what we hold about you, and give you a copy
correct anything that is wrong
delete what we hold
stop using it, or limit how we use it
send it to you, or to someone else, in a portable format
stop contacting you, by withdrawing your consent

We will not charge you for any of this, and we will answer within one month.

How to ask

Email or phone us using the details above, or use the Get started form and choose “Something else”. Tell us what you want us to do: see what we hold, correct it, or delete it.

If you want to complain

Tell us first, so we can put it right. If you are not satisfied with how we have handled your information, you can complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk. You can complain to them without telling us first.

Last updated 11 November 2026.