The purpose of this privacy notice is to ensure personal data processed by the company is done so in a lawful, fair and transparent manner in relation to the data subject and that individuals are well informed about the collection and use of their personal data.

Data controller details

The Company is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are as follows: Lee Cox, Managing Director, 01948 661400, or via email at dpo@springcare.org.uk

Our purposes for processing your personal data

We process personal data for some or all of the following purposes depending on our relationship with the individual data subject:

• To adhere with all statutory and regulatory requirements
• To safely recruit and employ our staff or volunteers
• To ensure our staff are appropriately trained
• To delivery our service
• For safeguarding
• To maintain the security of our premises
• To maintain and investigate crime
• To maintain the safety of our Service Users
• To allow effective and relevant communication
• Promoting and marketing our organisation

We cannot achieve these purposes without processing personal data.

We will not use your personal data for anything other than for the purposes set out above and we will never sell your personal data to third parties or share it with third parties without telling your (see Recipients of personal data below).

Our Lawful basis for processing your personal data

In addition to the above purposes we must have a valid lawful basis in order to process your personal data.

Therefore we have identified the following lawful bases:

• Contract
  • If you work for the company we will need to process your data to fulfil the terms and conditions of your employment.
  • If you enter into any form of contract with the Company this will be one of the appropriate lawful bases for processing your data. In this context, a contract does not have to be a formal signed document, or even written down.
  • Broadly speaking it means terms have been offered and accepted, we both intend for them to be legally binding, and there is an element of exchange usually on an exchange of goods or services for money, but this can be anything of value.
• Legal Obligation
  • We have a legal obligation to process our Service Users personal data in the Health and Social Care Act and to ensure we comply with CQC regulation.
  • We have a legal obligation to process our employees’ personal data in one or more of the Health and Social Care Act, the Health and Safety at Work Act, the Employment Rights Act and to ensure we have safe recruiting processes and procedures.
  • Sometimes we may have a legal obligation to process your data even if you are not an employee or Service User. For example if you are a contractor working for us and you have an accident we might have to report it to the Health and Safety Executive.
• Legitimate Interests
  • We use legitimate interests as our valid lawful basis if there is no legal or contractual obligation for the processing activity but data will be used in ways you would reasonably expect and will have minimal impact on your privacy.
• Consent
  • We use consent as our valid lawful basis when we are able to offer you real choice and control over your data and when you are able to withdraw your consent without any adverse consequences. For example we will ask for your consent before we use photographs or videos in promotional material, on our website or social media.

Our Legitimate Interests

We have identified legitimate interests as the basis for the following processing activities; Fundraising and volunteering, the operation of our CCTV system the administration of basic first aid and vaccinations and to ensure we communicate effective and relevant information to the appropriate recipient/s.

The legitimate interests for fundraising and volunteering are very simple; to help us to raise funds for our resident comfort fund and to utilise volunteers who want to work with us.

The legitimate interest for operating our CCTV are; it will help us to maintain the security of our premises from intruders, prevent and investigate crime and maintain the health and safety of our Service Users, staff and visitors.

The legitimate interests for administering basic first aid and vaccinations are; to minimise injury or in some case maintain life and maintain the health and safety of our Service Users, staff and visitors.

The legitimate interest for effective and relevant communication are; to ensure the correct information is available to the correct recipient at the correct time and in the best interest of the data subject.

Sources and categories of personal data obtained

Sometimes the Company will need to collect personal data from sources other than the individual it relates to. These sources include:

• Previous placements including residential, nursing or hospital
• Social workers
• Local authorities
• Health commissioning groups
• Health and medical professionals including therapists
• Personal assistants and informal carers
• Advocates
• The courts and the police
• Relevant persons representative
• The Disclosure and Barring Service
• Previous Employers
• Court appointed deputy
• Independent case workers
• Other legal representatives

The following list describes the categories of personal data the Company might collect from sources other than the individual it relates to:

• Name and contact details
• Health, medical and therapy details
• Employment history details
• Care plan details
• Education details
• Financial details
• Risk Assessments
• Behaviour reports and details
• Personal details such as gender, DOB or NI number
• Details of criminal convictions or offences
• Court Orders
• Support plans
• Photographs and video

Recipients of personal data

There are times when we will need to share personal data with other organisations or third parties.

We will only do this in line with the purposes set out above and we will make sure appropriate steps are taken to protect the security of personal data before it is shared.

The Company shares personal data with the following organisations or third parties if and when required:

• Our insurers and solicitors
• Social services
• The Care Quality Commission
• Our pension provider
• Local authorities
• The NHS and other medical professionals
• Previous employers when asking for references
• Future and potential employers
• Future and potential placements for Service Users
• External training providers
• The Health and Safety Executive
• The courts and the police
• HMRC
• BACS payment services
• Advocates
• The Disclosure and Barring Service
• The Department for Work and Pensions.

Retention Periods

The retention period applied to personal data we process is defined in our Retention Policy which is available upon request.

Individual Rights

The following individual rights may be available depending on the category of data being processed, the purpose and lawful base for the processing activity and the retention period applied:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure (or to be forgotten)
• The right to restrict processing
• The right to data portability
• The right to object

For further information on these rights you can visit the Information Commissioners Office website at www.ico.org.uk

Any request to exercise the above rights should be made in writing and addressed to the Data Controller at Nicholson House, Shakespeare Way, Whitchurch Business Park, Whitchurch, Shropshire, SY13 1LJ.

You have the right to lodge a complaint or report a concern about organisations personal data processing activity at any time.  You should do this by contacting the Information Commissioners Office.

Statutory or Contractual Requirement

There is both a statutory and contractual requirement for you to provide your personal data to the Company if you work for us or apply to work for us.

There is a statutory requirement for you to provide your personal data to the Company in order for us to deliver our service to you.

Existence of Automated Decision Making

The Company does not apply any automated decision making to the personal data we process.