Privacy Policy

---

PRIVACY POLICY

CARIAD CARE LTD

Cariad Care Ltd (“Cariad Care”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal information we process.

This Privacy Policy explains how we collect, use, store, share and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

1. Who We Are

Cariad Care Ltd provides specialist crisis staffing and bridging support for children and young people with complex and highly complex needs. Our services may be delivered within accommodation arranged or provided by a commissioning authority and, where appropriate, within family or community settings.

Cariad Care Ltd is the Data Controller for personal information where we determine the purposes and means of processing. Where we process information on behalf of a commissioning organisation, our respective data protection responsibilities will be determined by the applicable contractual arrangements.

Registered Office:
The Long Barn East
Mythe Business Centre
Tewkesbury
Gloucestershire
GL20 6EA

Email: hello@cariad-care.co.uk
Telephone: 0333 880 1505
ICO Registration Number: ZC257931

Questions about this Privacy Policy or the way we process personal information should be directed to Cariad Care’s Data Protection Lead using the contact details above.

2. Personal Information We Collect

The information we process will depend upon our relationship with the individual and the services being provided.

For children and young people receiving support, this may include:

• Name, date of birth and contact information
• Care and support plans
• Risk assessments and risk-management information
• Health, medical and medication information where relevant
• Safeguarding information
• Behavioural and emotional support information
• Education and professional information
• Incident, accident and daily records
• Information relating to the child or young person's views, wishes      and feelings
• Family, carer and emergency contact information
• Information provided by local authorities, social workers and other      professionals
• Information necessary to safely deliver, monitor and review      commissioned support

For employees, workers, contractors and applicants, we may process:

• Identification and contact information
• Employment history and references
• Right-to-work documentation
• Qualifications and training records
• DBS and safer recruitment information
• Payroll and bank information
• Supervision and performance information
• Employment records
• Health information where relevant and lawful
• Emergency contact information

We may also process information relating to commissioners, professionals, suppliers and individuals who contact Cariad Care.

3. How We Use Personal Information

We process personal information where necessary to:

• Deliver safe and effective support to children and young people
• Assess and manage risks
• Maintain accurate support and service records
• Meet safeguarding responsibilities
• Communicate with local authorities, families and relevant      professionals
• Provide reports and information required by commissioning      authorities
• Respond to incidents, concerns and complaints
• Recruit, manage and support our workforce
• Meet contractual requirements
• Manage invoicing and financial administration
• Meet legal and regulatory obligations
• Monitor and improve the quality and safety of our services
• Protect the rights, safety and wellbeing of children, young people,      staff and others

We only collect and process information that is relevant and necessary for the purpose for which it is required.

4. Lawful Basis for Processing

Cariad Care will only process personal information where there is a lawful basis for doing so.

Depending upon the circumstances, this may include:

• Contract – where processing is necessary to enter      into or fulfil contractual obligations.
• Legal obligation – where processing is required to comply      with a legal requirement.
• Legitimate interests – where processing is necessary for      legitimate organisational purposes and those interests do not override the      rights of the individual.
• Vital interests – where processing is necessary to      protect someone's life.
• Public task – where applicable to processing      undertaken in connection with statutory functions.
• Consent – where consent is the appropriate      lawful basis. Where relied upon, consent will be freely given, specific,      informed and capable of being withdrawn.

Some of the information Cariad Care processes is special category data, including health information.

Where special category information is processed, an appropriate condition under Article 9 UK GDPR and, where applicable, the Data Protection Act 2018 will also be identified. This may include processing necessary for health or social care, employment obligations, safeguarding and substantial public interest purposes.

5. Sharing Personal Information

Personal information will only be shared where there is a lawful and legitimate reason to do so and only to the extent necessary for that purpose.

Depending upon the circumstances, information may be shared with:

• Local authorities and commissioning organisations
• Social workers and safeguarding professionals
• Health professionals
• Education professionals
• Emergency services
• Other professionals involved in the child or young person's support
• Payroll, HR, IT and software providers where necessary
• Legal and professional advisers
• Statutory or regulatory bodies where legally required
• Law enforcement agencies where required or permitted by law

Where third parties process personal information on our behalf, appropriate contractual and data protection arrangements will be used where required.

Cariad Care does not sell personal information.

6. How We Protect Personal Information

Cariad Care maintains appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

These measures include:

• Company-issued, password-protected equipment
• Individual user accounts and controlled system access
• Role-based access to information
• Multi-factor authentication where applicable
• Antivirus and anti-malware protection
• Encryption where appropriate
• Secure cloud-based storage and backup arrangements
• Secure electronic care-record systems
• Secure methods for sharing sensitive information
• Physical security for paper records
• Staff confidentiality requirements
• Data protection and information-security training
• Regular review and audit of data protection and      information-security arrangements

Personal or confidential information must not be stored or accessed using unauthorised personal equipment.

7. Data Retention and Disposal

Personal information will only be retained for as long as necessary for the purpose for which it was collected and in accordance with applicable legal, contractual, safeguarding and regulatory requirements and Cariad Care’s retention arrangements.

When information is no longer required, it will be securely disposed of.

Electronic information will be securely deleted in accordance with applicable system and backup arrangements. Confidential paper records will be securely destroyed using cross-cut shredding.

8. International Data Transfers

Cariad Care operates within the United Kingdom and does not routinely transfer personal information outside the UK.

Where an international transfer becomes necessary, it will only take place where permitted by data protection legislation and appropriate safeguards are in place.

Where Cariad Care processes Council data under a commissioning arrangement requiring UK-only processing, that data will not be transferred outside the UK without the prior agreement of the commissioning authority and appropriate lawful safeguards.

9. Your Rights

Individuals have rights in relation to their personal information under UK data protection legislation. Depending upon the circumstances, these include:

• The right to be informed about how information is used
• The right of access to personal information
• The right to request correction of inaccurate information
• The right to request erasure in certain circumstances
• The right to restrict processing in certain circumstances
• The right to object to certain processing
• The right to data portability where applicable
• Rights relating to automated decision-making and profiling
• The right to withdraw consent where consent is relied upon

Requests relating to these rights should be made to Cariad Care using the contact details contained within this policy.

Requests will be handled in accordance with the timescales and requirements of UK data protection legislation.

10. Data Breaches

Any suspected loss, unauthorised disclosure or misuse of personal information will be investigated promptly in accordance with Cariad Care’s data breach and information-security procedures.

Where required by law, a personal data breach will be reported to the Information Commissioner’s Office within the applicable statutory timescale and affected individuals will be informed where required.

Where an incident involves information belonging to a commissioning authority, the authority will be notified in accordance with the applicable contractual and reporting requirements.

11. Complaints

Anyone who has concerns about the way Cariad Care has handled their personal information should contact us in the first instance so that the matter can be investigated.

Individuals also have the right to raise a complaint with the Information Commissioner’s Office (ICO).

Information Commissioner’s Office
Telephone: 0303 123 1113

Website: www.ico.org.uk

12. Cookies and Website Information

Where our website uses cookies, analytics or similar technologies, limited technical information may be collected to support website functionality, security and performance.

Cookie preferences can be managed through the relevant browser settings and any cookie controls provided on our website.

13. Monitoring and Review

Cariad Care regularly reviews its data protection and information-security arrangements to ensure that personal information continues to be processed securely and lawfully.

This Privacy Policy will be reviewed at least annually and sooner where there are significant changes to legislation, guidance, our services or the way personal information is processed.

14. Contact Us

For questions about this Privacy Policy, requests relating to personal information or concerns about the way information has been processed, please contact:

Cariad Care Ltd
The Long Barn East
Mythe Business Centre
Tewkesbury
Gloucestershire
GL20 6EA

Email: hello@cariad-care.co.uk
Telephone: 0333 880 1505
ICO Registration Number: ZC257931

Data Protection Lead: Managing Director