Privacy Notice

Who we are

Registration with Care Inspectorate Wales is in progress. Regulated domiciliary support will begin once registration is granted. Until then we can talk to you, understand what you need and hold your enquiry — and this notice explains how we look after the information you give us while we do that.

What this notice covers

This notice explains what personal information we may collect through this website, why we use it, the lawful bases we rely on under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, who we may share it with, and the rights you have.

It covers information collected through the website only — our enquiry forms, referral and assessment requests, callback and live chat requests, and recruitment enquiries. If you go on to receive care and support from us, or to work for us, we will give you further, more detailed privacy information at that point.

Information we may collect

We only ask for information we actually need, and most of the fields on our forms are there so that we can get back to you. Depending on which part of the website you use, we may collect:

Care enquiries

Your name, telephone number, email address if you give one, the area you live in, the best time to call, whether the enquiry is about you or about someone else, the kinds of support you are interested in, how often support might be needed, when it might be needed, and anything you choose to tell us in the message box.

Care assessment requests

Where you ask us to arrange or discuss an assessment, we may collect your contact details and information about the person who would be assessed, their circumstances, the support being considered and any preferences or risks you tell us about.

Referrals

Where a social worker, hospital team, GP practice, family member or other third party contacts us about someone, we may collect the referrer’s name, organisation and contact details, and information about the person being referred, including their name, contact details, circumstances and the support being sought.

Callback and live chat requests

Your name, telephone number, what you would like to talk about, and the messages exchanged in the live chat conversation. Where you ask for a callback from within the chat, a copy of that conversation may be sent to us with your request so that whoever calls you back has the context.

Recruitment and careers enquiries

Your name, telephone number, email address, the type of role and hours you are looking for, the areas you could work in, whether you drive, your experience and qualifications, your registration status with Social Care Wales, and anything you choose to tell us in the message box.

Contact information

Where you email us, call us or write to us directly, we hold the contact details you use and the content of your correspondence.

Information you include voluntarily in messages

The free-text boxes on our forms and the live chat are yours to use as you wish, so we cannot always predict what they will contain. Please only include what you feel is necessary at this stage. If you would rather not put something in writing on a website, please call us instead.

Health or care-related information, where you supply it

To answer an enquiry properly we may receive information about a person’s health, disability, medication, mobility, memory, mental health or care needs. We do not ask for clinical detail through the website, but where you or a referrer choose to give it, we treat it with extra care — see Health and other special category information below.

Recruitment information, where you supply it

Applicants may tell us about their employment history, qualifications, training, availability and professional registration. Later stages of recruitment involve further checks, including an enhanced Disclosure and Barring Service (DBS) check, references and registration with Social Care Wales. Those checks happen outside this website, and we will explain them to you separately before they are carried out.

Technical information

Our hosting provider records limited technical information such as the internet protocol (IP) address of the device making a request, the date and time, the pages requested and basic browser information. This is used to deliver the website, keep it available and protect it from abuse. Our Cookie Policy explains the technologies this website uses.

Why we use your information

We use the personal information described above for the following purposes:

• responding to enquiries and answering questions about our services
• arranging, preparing for and following up assessments of care and support needs
• dealing with referrals from professionals, families and other third parties
• communicating with prospective service users, their families and their representatives, including calling you back when you ask us to
• recruitment, including responding to job enquiries and progressing applications
• safeguarding children and adults at risk, where that applies
• meeting our legal and regulatory obligations, including those connected with our application to register with Care Inspectorate Wales and, once registered, with the requirements that apply to a registered service
• keeping proper records of the enquiries and referrals we receive and the decisions we take on them
• managing, maintaining and securing this website, and preventing spam, fraud and misuse of our forms
• improving how we explain our services, based on the questions people actually ask us

We do not use the information collected through this website for marketing lists, profiling or automated decision-making, and we do not sell it to anyone.

Our lawful bases under UK GDPR

We must have a lawful basis for each use of your personal information. Depending on what you have asked us to do, we rely on:

Contract and pre-contractual steps — Article 6(1)(b)

Where you ask us about care and support, ask for an assessment or ask us to call you back, we process your information in order to take steps at your request before entering into any agreement, and afterwards to perform an agreement you enter into with us.

Legitimate interests — Article 6(1)(f)

We rely on our legitimate interests in running and developing a care and support service, in dealing with referrals made to us by third parties, in recruiting suitable staff, in keeping records of enquiries, and in keeping this website secure and free from abuse. We only rely on this basis where doing so is fair to you and does not override your rights and freedoms.

Legal obligation — Article 6(1)(c)

Some processing is necessary to comply with the law, for example obligations relating to safeguarding, employment, health and safety, and social care regulation and inspection in Wales.

Consent — Article 6(1)(a)

Where consent is the appropriate basis, for example when you tick the box confirming you are happy for us to contact you about your enquiry, or if we ever ask to keep your details on file for longer than your original enquiry requires. Where we rely on consent you can withdraw it at any time, and withdrawing it will not affect anything we have already done lawfully.

Vital interests — Article 6(1)(d)

In rare cases, where someone’s life or safety is at immediate risk, we may need to process and share information to protect them.

Health and other special category information

Information about a person’s health, disability or care needs is “special category” personal data under UK GDPR, and information about criminal offences and convictions has its own protections. This type of information gets extra protection in law, and we treat it accordingly.

We will only process special category information where, in addition to a lawful basis under Article 6, an appropriate condition under Article 9 UK GDPR and the Data Protection Act 2018 applies. Depending on the circumstances that may be:

• your explicit consent, where consent is appropriate and freely given
• that the processing is necessary for the provision of health or social care, or the management of health or social care systems and services
• that the processing is necessary to protect the vital interests of someone who is physically or legally incapable of giving consent
• that the processing is necessary for reasons of substantial public interest, including safeguarding children and individuals at risk
• that the processing is necessary in connection with legal claims or legal obligations in the field of employment and social protection

Live chat and callbacks

The assistant in our live chat is automated software, not a care professional. It is there to answer general questions about the areas we cover, the support we plan to offer, how we pay our carers and where we are with registration.

The messages you type are sent to an artificial intelligence service provider that generates the assistant’s replies on our behalf, acting as our processor under contract. The conversation is held in your browser for the length of your visit and is not saved to your device. We only receive a copy of the conversation if you use the “Ask for a call back” form inside the chat, in which case the transcript is submitted to us together with your name and telephone number so that we can respond usefully.

Please do not enter medical details, financial information, dates of birth or full addresses into the chat. If you need to discuss something sensitive, please call us or use the enquiry form.

Who we may share information with

We do not sell personal information and we do not share it with anyone who does not need it. We may share it with:

• Netlify — the platform that hosts this website and processes our form submissions and the live chat requests on our behalf. Form submissions are stored in our account with Netlify and notified to us by email.
• Our email, telephony and IT providers — who necessarily handle the messages and calls that reach us, and who support the systems we use to keep records.
• An artificial intelligence service provider — which generates the live chat assistant’s replies on our behalf, as described above.
• Professional advisers — such as our legal, insurance, human resources and accountancy advisers, where they need the information to advise us.
• Health and social care organisations and public authorities — such as local authority adult social services or children’s services, health boards, GP practices, hospital discharge teams, Care Inspectorate Wales and Social Care Wales, where sharing is lawful and necessary, for example to progress a referral, arrange an assessment, or meet a regulatory requirement.
• Safeguarding partners — where we have a concern that a child or an adult at risk is being harmed or is at risk of harm, we may need to make a safeguarding referral to the relevant local authority, the police or another appropriate body. We will normally tell the person concerned that we are doing so, unless doing so would increase the risk to them or obstruct an investigation.
• Emergency services — where someone’s life or safety is at immediate risk.
• Regulators, courts and law enforcement — where we are required or permitted by law to disclose information.

Where we use a supplier to process personal information for us, we put a written contract in place that requires them to act only on our instructions and to keep the information secure.

How long we keep information

We keep personal information only for as long as it is necessary for the purpose we collected it for. How long that is depends on:

• the purpose the information was provided for, and whether that purpose is still live
• whether the enquiry, referral or application progressed, and what was agreed
• legal, regulatory and professional requirements that apply to care and support providers in Wales, including any record-keeping duties connected with regulation by Care Inspectorate Wales
• our need to keep a record in case of a query, complaint or legal claim
• our retention policies, which we review as our service develops

We are not going to quote fixed retention periods here that we cannot yet stand behind. Enquiries that do not go anywhere are not kept indefinitely. When information is no longer needed it is securely deleted or anonymised. If you want to know how long we would hold something specific, ask us and we will tell you what our policy says.

Keeping information secure

We take appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access or disclosure. These include:

• serving this entire website over an encrypted HTTPS connection
• using reputable providers whose platforms are protected by access controls and encryption
• limiting access to enquiry and referral information to the people at Journeys Kind who need it to do their job
• requiring confidentiality of everyone who works for us, with training that includes data protection and safeguarding
• spam and abuse protection on our forms, so that they are not used to harvest or flood our systems
• reviewing our arrangements as the organisation grows

No transmission over the internet can be guaranteed to be completely secure. If we ever suffer a personal data breach that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within the required time and, where the risk is high, tell the people affected.

International transfers

We aim to keep personal information within the United Kingdom or the European Economic Area wherever we can. Some of the technology suppliers we rely on, including our website and form hosting platform and the provider of the live chat assistant, are organisations based outside the UK or which operate infrastructure in other countries. That means some information may be transferred to, or accessible from, outside the UK.

Where a transfer of personal information outside the UK takes place, we take steps to make sure it is protected to the standard required by UK data protection law — for example by relying on UK adequacy regulations for the country concerned, or by putting in place the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with any additional safeguards that are appropriate. You can ask us for more information about the safeguards that apply.

Your rights

Under UK GDPR you have the following rights, which you can exercise free of charge in most cases:

• To be informed about how we use your personal information — which is what this notice is for.
• Of access — to ask for a copy of the personal information we hold about you.
• To rectification — to have inaccurate information corrected and incomplete information completed.
• To erasure — to ask us to delete your personal information where there is no good reason for us to continue holding it.
• To restrict processing — to ask us to pause our use of your information in certain circumstances, for example while a dispute about its accuracy is resolved.
• To object — to object to processing we carry out on the basis of our legitimate interests, and to object at any time to direct marketing.
• To data portability — to receive certain information you gave us in a structured, commonly used and machine-readable form, and to have it sent to another controller where technically possible.
• To withdraw consent — where we rely on your consent, you may withdraw it at any time.
• Not to be subject to solely automated decisions that have a legal or similarly significant effect on you. We do not make decisions about people in that way.

Some of these rights apply only in particular circumstances, and there are exemptions in the legislation. To exercise a right, email enquiries@journeyskind.org or call us. We may need to confirm your identity, or your authority to act for someone else, before we respond. We will reply within one month of receiving a valid request, and we will tell you if we need longer because the request is complex.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first — email enquiries@journeyskind.org and we will look into it properly.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at any time:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Complaining to the ICO will not affect any other rights you have, and you do not need our permission to do it.

Changes to this notice

We will update this notice as our service develops — in particular once registration with Care Inspectorate Wales is granted and we begin delivering regulated support. The date at the top of this page shows when it was last reviewed. Where a change is significant we will draw attention to it on the website.