STATUTORY DATA PROTECTION & PRIVACY STATEMENT
Purpose: Satisfies the mandatory disclosure requirements of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
1. Data Controller Identification
2. Lawful Basis for Processing Data
We collect and process personal data (including names, addresses, contact details, and emergency contacts) under the following lawful bases:
- Contractual Necessity: To schedule, manage, and execute companionship bookings.
- Legitimate Interests: To safely coordinate domestic support and maintain communication with authorised family members.
- Legal Obligation: To fulfill standard corporate accounting, tax, and safeguarding reporting requirements.
- Categories of Recipients: We may share personal data with: DBS/background-check providers for staff vetting; accounting and invoicing software providers; electronic signature providers (e.g. Signable, DocuSign) for agreement signing; and local authority safeguarding teams where a safeguarding concern requires referral. We do not share data with marketing third parties.
3. Data Retention and Security Protocols
- Security Measures: All client data is encrypted and stored securely within restricted-access digital systems.
- No Marketing Shares: We never trade, rent, or sell consumer data to third-party marketing networks.
- Your Rights: Under UK GDPR, you have the right to request access to, correction of, or erasure of your personal data; to object to or request restriction of our processing; to data portability where applicable; and to withdraw consent at any time where we rely on it. You can exercise these rights by contacting us at info@eldercompanionservices.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data has been mishandled.
- Retention: We retain client personal data for the duration of the service agreement, plus 6 years afterward to meet accounting and tax obligations (in line with HMRC requirements). Safeguarding-related records, where applicable, are retained in line with statutory safeguarding guidance. Data is securely deleted once these periods expire.
