Customer Privacy Notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Email: info@secondspringcompanions.co.uk

What information we collect, use, and why

Note on photographs: Photographs are collected only with your explicit written consent and will not be shared with third parties without your further consent. You may withdraw this consent at any time by contacting us.

We also collect the following special category information to provide our services. This information is subject to additional protection due to its sensitive nature:

• Racial or ethnic origin
• Religious or philosophical beliefs
• Health information

Article 9 condition (UK GDPR): We process special category data on the basis of substantial public interest for social care purposes (Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018), and where necessary to protect your vital interests.

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. You can find out more about lawful bases on the ICO's website at ico.org.uk.

Which lawful basis we rely on may affect your data protection rights, which are set out briefly below:

• Your right of access — you have the right to ask us for copies of your personal information.
• Your right to rectification — you have the right to ask us to correct or delete information you think is inaccurate or incomplete.
• Your right to erasure — you have the right to ask us to delete your personal information.
• Your right to restriction of processing — you have the right to ask us to limit how we use your information.
• Your right to object to processing — you have the right to object to the processing of your personal data.
• Your right to data portability — you have the right to ask us to transfer your information to another organisation or to you.
• Your right to withdraw consent — where we rely on consent, you have the right to withdraw it at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the details at the top of this notice.

Where we get personal information from

• Directly from you
• Family members or carers
• Companions who provide service verification logs, attendance records, and incident reports

How long we keep information

We retain personal information only for as long as is necessary for the purposes set out in this notice, or as required by law. Our retention schedule is as follows:

For more information on how long we store your personal information, or to request details about the criteria we use to determine retention periods, please contact us using the details above.

Who we share information with

Data processors

We use the following organisations to process personal data on our behalf:

Others we share personal information with

• Organisations we need to share information with for safeguarding reasons
• Emergency services
• Professional advisors (e.g. solicitors, accountants)
• Organisations we are legally obliged to share personal information with (e.g. HMRC, courts)

Duty of confidentiality

We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information:

• Where you have provided us with your consent (implied for care provision, or explicit for other uses);
• Where we have a legal requirement (including court orders) to collect, share or use the data;
• Where, on a case-by-case basis, the public interest in sharing the data overrides the duty of confidentiality (for example, sharing information with the police to support the detection or prevention of serious crime);
• Where the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied.

Data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. Where required, we will also report the breach to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it. We maintain an internal record of all data breaches, including those that do not require notification.

Automated decision-making and profiling

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you. All decisions relating to your care and service provision are made by our staff.

Cookies and our website

Our website (secondspringcompanions.co.uk) may use cookies or similar technologies. Where this is the case, we provide a separate Cookie Policy explaining what cookies we use, why we use them, and how you can manage your preferences. If you have questions about our website cookies, please contact us using the details above.

Sharing information outside the UK

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place. The table below summarises these transfers:

For further information or to obtain a copy of the appropriate safeguard for any of the above transfers, please contact us using the contact details provided above.

How to complain

If you have any concerns about our use of your personal data, please raise them with us first using the contact details at the top of this notice. We will respond promptly and take your concerns seriously.

If you remain unhappy after raising a complaint with us, you can also complain to the ICO: