GDPR Privacy Notice

1. Who we are

Prime Years Care Agency is the data controller responsible for personal information processed in connection with our website and services. For questions about how we use your information, or to exercise your data protection rights, contact dpo@primeyearscareagency.com.

2. Information we collect

We may collect website and device information such as IP address, browser, device type, pages visited and cookie information. If you contact us, we may collect your name, contact details and the information you choose to provide. Care enquiries may include information about circumstances, care needs, preferences, and support requirements. Recruitment applications may include CVs, interview information, references, and relevant pre-employment checks. We may also process communications for responding to you and maintaining appropriate records.

3. How we use your information

We may use personal information to:

• Respond to enquiries and assessment requests.
• Provide, manage, and assess care and companionship services.
• Communicate with clients, family representatives, and healthcare professionals where appropriate.
• Process recruitment applications, identity verifications, and pre-employment checks.
• Manage our services, client relationships, and care quality standards.
• Improve our website performance and understand website traffic where appropriate.
• Meet legal, regulatory (including CQC), and contractual obligations.
• Prevent or investigate fraud, misuse, or unlawful activity.

4. Lawful basis for processing

Depending on the circumstances, our lawful bases may include consent, contract, legal obligation, legitimate interests, and vital interests. Where we process special category information, such as health information, we will also rely on an appropriate Article 9 condition under UK GDPR and, where required, an additional condition under the Data Protection Act 2018.

5. Special category data

Some information processed for care services is special category data, particularly information concerning health and medical conditions. We recognise that this information requires additional protection. We will collect only information necessary for the relevant purpose, keep it secure, restrict access strictly to authorised personnel, and retain it only as long as necessary.

6. Cookies and similar technologies

Our website may use cookies and similar technologies. Some are necessary for the website to function; optional analytics or marketing cookies will be used in accordance with applicable consent requirements. You may manage cookies through your browser settings and, where provided, our cookie controls and consent preferences.

7. Third-party services

We may use trusted third-party providers for website hosting, communications, analytics, recruitment, care management, payments, or other essential business functions. Where they process information on our behalf, we require appropriate data protection safeguards. We may also disclose information where required by law, regulation, court order, or another lawful authority request.

8. External links

Our website may contain links to other websites. Once you leave our website, the other organisation's privacy practices apply. We encourage you to read their privacy notice. We are not responsible for external websites.

9. Security

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration, or destruction. Access is strictly restricted to people who need information for legitimate care delivery or administrative purposes.

10. Retention

We retain personal information only for as long as necessary, taking account of legal, regulatory, contractual, operational, and safeguarding obligations. Different information may therefore be retained for different periods. Our retention arrangements are reviewed regularly, and information is securely deleted, destroyed, or anonymised when no longer required.

11. Your data protection rights

Depending on the circumstances, you have the right under UK GDPR to:

• Be informed about how your personal data is being used.
• Access the personal information we hold about you (Subject Access Request).
• Rectify inaccurate or incomplete personal information.
• Request erasure of personal data where there is no compelling reason for its continued processing.
• Restrict processing of your personal data under certain conditions.
• Object to processing based on legitimate interests or direct marketing.
• Data portability to obtain and reuse your personal data across different services where applicable.
• Withdraw consent at any time where consent is our lawful basis.

These rights are subject to legal conditions, exemptions, and safeguarding requirements.

12. Withdrawing consent

Where we rely on consent as the lawful basis for processing, you can withdraw it at any time by emailing dpo@primeyearscareagency.com. Withdrawal will not affect processing carried out prior to withdrawal or processing based on another lawful basis.

13. Marketing

Where required, we will obtain consent before sending electronic marketing communications. You can unsubscribe at any time using the provided link or by contacting dpo@primeyearscareagency.com.

14. Data breaches

If we become aware of a personal data breach, we will assess the risks immediately and take appropriate containment and remedial action in accordance with our legal and regulatory obligations, including notifying the Information Commissioner's Office (ICO) within 72 hours and affected individuals where required by law.

15. Questions, requests or complaints

For questions, concerns, Subject Access Requests, or complaints about how Prime Years Care Agency handles personal information, please contact our Data Protection team at dpo@primeyearscareagency.com. We will investigate and respond promptly in accordance with statutory requirements.

16. Right to complain to the ICO

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection. Further guidance and complaint details are available at https://ico.org.uk/ or by calling their helpline on 0303 123 1113.

17. Changes to this privacy notice

We may update this notice to reflect changes to our services, website, technology, legal requirements, or data processing activities. The latest version will always be published on this page with the date of last review.

18. Contact details