Support Social Care Heroes Limited

Customer privacy notice

This privacy notice tells you what to expect us to do with your personal information when you interact with Social Care Heroes and Support Social Care Heroes Limited, including our Social Care Heroes Awards and other wellbeing and recognition initiatives, or when you visit our website or use our online forms.

We are committed to respecting your privacy and keeping your information safe.

1. Who we are and how to contact us

Support Social Care Heroes Limited (also known as “Social Care Heroes”, “we”, “us” or “our”) is the organisation responsible for the personal information we collect and use in connection with our services and initiatives.

Contact details

Organisation name: Support Social Care Heroes Limited

Postal address: Unit 9 Westbrook Court, Sharrowvale Road, Sheffield, United Kingdom, S11 8YZ

Company number: 13043432

Email: info@socialcareheroes.org.uk

If you have any questions about this privacy notice or how we use your information, you can contact us using the details above.

2. The personal information we collect

The information we collect depends on how you interact with us. We will only collect the information we need for the purposes set out in this notice.

2.1 People we support, nominees and people using our services

This includes people who are nominated for Social Care Heroes Awards, people we support through our initiatives, and people who use related services.

We may collect:

– Names and contact details

– Addresses

– Employer details and role (for example, social care organisation and job title)

– Information about your work in social care and your achievements

– Insurance policy details

– Records of meetings and decisions

– Call recordings

– Information about income and financial needs where this is relevant (for example, for funding or personal budget support)

– Records of your interactions with us, including any posts, messages or other content you submit to our platforms, as well as metadata such as the time and date of your activity

We may also collect the following special category information, which is subject to additional protection because of its sensitivity:

– Racial or ethnic origin

– Religious or philosophical beliefs

– Health information

– Sex life information

– Sexual orientation information

We only collect this information where it is relevant to the support or recognition we provide, or where you choose to share it with us.

2.2 User app or portal functionality

If you use any Social Care Heroes app, portal or online platform, we may collect:

– Names and contact details

– Addresses

– Medical history or health-related information where relevant to our wellbeing initiatives

– Payment details (if you purchase products or services from us)

– Account information, including registration details and login information

– Information used for security purposes (for example, passwords, security questions, device information)

– Marketing preferences

– Community discussion content and contributions (for example, comments, posts, and messages)

We may also collect special category information where you choose to share it or where it is relevant to our services:

– Racial or ethnic origin

– Religious or philosophical beliefs

– Health information

– Sex life information

– Sexual orientation information

2.3 Information we collect to comply with legal requirements

To meet our legal and regulatory obligations, we may collect:

– Name and contact information

– Identification documents

– Health and safety information

– Financial information

– Any other personal information required to comply with legal obligations

– Right to work information

– Insurance details

– Tax information

– Safeguarding information

– Criminal offence data

We may also collect special category information such as:

– Racial or ethnic origin

– Health information

and criminal offence data where this is required for safeguarding, recruitment, or regulatory reasons.

2.4 Recruitment and employment

If you apply for a role with us, are part of our talent pool, or work with us, we may collect:

– Contact details (name, address, telephone number, personal email address)

– Date of birth

– National Insurance number

– Copies of passports or other photo ID

– Employment history (job applications, CV, employment references, secondary employment)

– Education history (qualifications, training)

– Social media information where relevant to your application or public and professional profile

– Right to work information

– Details of any criminal convictions (for example, DBS, Access NI or Disclosure Scotland checks)

– Security clearance details, where applicable

We may also collect special category information such as:

– Racial or ethnic origin

– Religious or philosophical beliefs

– Trade union membership

– Health information (for example, fitness to work, reasonable adjustments)

2.5 Information updates, marketing and market research

If you sign up to hear from us, take part in our research or engagement activities, or complete our surveys or forms (including forms on our website or via Google Forms), we may collect:

– Names and contact details

– Addresses

– Marketing preferences

– Website and app user journey information

– IP addresses and other online identifiers

– Personal information used for administration of research or surveys

– Personal information used for the purpose of research (for example, your views, experiences or responses)

– Records of consent, where appropriate

Where possible, we analyse survey responses in anonymised or aggregated form, particularly when we share findings externally. We will not share identifiable individual survey responses with employers unless we have made this clear and have obtained your explicit consent.

2.6 Dealing with queries, complaints or claims

If you contact us with a question, concern, complaint or claim, we may collect:

– Names and contact details

– Addresses

– Payment details (if relevant)

– Account information

– Purchase or service history

– Video and audio recordings of public areas, and where relevant, private or staff-only areas (for example, if an incident occurs at an event)

– Call recordings

– Correspondence and notes about your query or complaint

We may also collect special category information such as:

– Racial or ethnic origin

– Religious or philosophical beliefs

– Trade union membership

– Health information

– Sexual orientation information

2.7 Website visitors, cookies, comments and embedded content

When you visit our website, we may collect limited technical information to help the site run properly and to understand how people use it. This may include:

– IP address

– Browser type and version

– Time zone setting

– Operating system and device type

– Information about how you use the site (for example, pages visited and links clicked)

– Information from cookies and similar technologies

If you leave a comment on our site (where comments are enabled), we collect:

– The information you enter in the comments form (such as your name, email address and website)

– Your IP address and browser user agent string to help detect and prevent spam

If you choose to save your details when commenting, we will use cookies so your name, email address and website are remembered the next time you comment. These cookies normally last for around one year.

Comments and their metadata may be retained so that we can recognise and approve follow-up comments automatically instead of holding them in a moderation queue.

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS), as visitors to the website could download and extract this information.

Our website may include embedded content (for example, videos, images or articles) from other websites. Embedded content from other websites behaves in the same way as if you visited the other website directly. Those websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with that content (including tracking your interaction if you have an account and are logged in to that website). We encourage you to read the privacy notices of those websites.

We use tools such as Google Analytics to collect anonymised statistics about how visitors use our website (for example, which pages are visited and how long people spend on them). This helps us improve our content and user experience. Google uses this information in line with its own privacy policy.

We may use services such as Akismet to help detect spam comments. This typically involves sending commenter information (such as IP address, user agent, referrer and site URL, along with the comment data) to the Akismet service.

If you use a Gravatar account, an anonymised string (hash) of your email address may be sent to the Gravatar service to check if you are using it. After your comment is approved, your Gravatar profile picture may be visible to the public in the context of your comment.

Our website is built using WordPress and related plugins. These may process technical data and set cookies in order to provide their functionality. For more information, you can refer to WordPress and Automattic’s privacy information.

3. Where we get personal information from

We may get information:

– Directly from you

– From forms and surveys you complete on our website or via tools such as Google Forms

– From regulatory authorities

– From other health and care providers

– From charities or voluntary sector organisations

– From schools, colleges, universities or other education organisations

– From councils and other public sector organisations

– From previous employers (for references)

– From suppliers and service providers

– From publicly available sources

– From CCTV footage or other recordings where relevant

We do not routinely collect personal information from other sources beyond those described above.

4. Our purposes and lawful bases for using personal information

Under UK data protection law, we must have a lawful basis for using your personal information. The main lawful bases we rely on are:

– Consent – you have given us clear consent for a specific purpose (for example, marketing emails).

– Contract – we need your information to provide you with services or to take steps at your request before entering into a contract.

– Legal obligation – we need to use your information to comply with the law.

– Legitimate interests – we use your information in ways you would reasonably expect, for our own legitimate interests or those of a third party, and we have checked that these do not override your rights.

– Vital interests – we use your information to protect someone’s life in an emergency.

For special category information (such as health) and criminal offence data, we rely on additional legal conditions, for example:

– Providing and managing health and social care services

– Safeguarding individuals

– Employment, social security and social protection law

– Substantial public interest

Below, we explain our main purposes and where we rely on legitimate interests.

4.1 To provide care, recognition and other services

We use your information to:

– Manage our relationship with you and the organisations and individuals involved in your care or support

– Provide, monitor and improve our services and initiatives, including our Social Care Heroes Awards and wellbeing activities

– Assess nominations and recognise social care professionals

– Keep accurate records of the support and services we provide

– Safeguard individuals and protect their wellbeing

– Respond to enquiries, feedback and concerns about our services

– Manage our business operations, including quality assurance, audits and governance

– Establish, exercise or defend legal claims, if needed

Lawful bases:

– Contract

– Legal obligation

– Legitimate interests

– Vital interests (in urgent situations)

Our legitimate interests are to:

– Manage our relationship with you and the people or organisations involved in your care or support

– Provide, monitor and improve our services so they remain safe, effective and responsive

– Keep accurate records of the care, support and services we provide

– Safeguard individuals and protect their wellbeing

– Respond to enquiries, feedback and concerns about our services

– Manage our business operations, including quality assurance, audits and governance

– Establish, exercise or defend legal claims if needed

4.2 User app or portal functionality

We use your information to:

– Create and manage user accounts

– Provide secure and reliable access to our online services, app or portal

– Personalise your experience and tailor content

– Monitor use of the app or portal to improve usability, performance and accessibility

– Prevent and detect abuse, misuse, fraud or unauthorised access

– Provide support and resolve any technical issues you report

Lawful bases:

– Contract

– Legitimate interests

Our legitimate interests are to:

– Provide you with secure and reliable access to our online services

– Protect the security and integrity of our systems and data

– Monitor use of the app or portal to improve usability, performance and accessibility

– Prevent and detect abuse, misuse, fraud or unauthorised access

– Provide support and resolve any technical issues you report

– Tailor information in the app or portal so it is more relevant and helpful to you

4.3 To comply with legal and regulatory requirements

We use your information to meet our legal and regulatory obligations, cooperate with regulators and public bodies, respond to lawful requests for information, manage safeguarding concerns and incidents, and manage tax, accounting and reporting obligations.

Lawful bases:

– Legal obligation

– Substantial public interest (for certain safeguarding and regulatory activities)

– Legitimate interests

Our legitimate interests are to maintain appropriate business records, manage risk and governance, cooperate with regulators beyond strict legal requirements where this improves safety and quality, and establish, exercise or defend legal claims.

4.4 Recruitment and employment

We use your information to assess your suitability for roles, communicate with you during recruitment, carry out background checks, make fair and informed recruitment decisions, keep recruitment records, and manage relationships with employees, workers, volunteers and contractors.

Lawful bases:

– Contract

– Legal obligation

– Legitimate interests

– Employment, social security and social protection law

Our legitimate interests are to assess your skills and suitability, keep records of recruitment decisions for fairness and transparency, and maintain a talent pool where appropriate (unless you ask us not to).

4.5 Information updates, marketing and market research

We use your information to send updates about our work, initiatives, events and opportunities, tell you about ways to get involved or support Social Care Heroes, understand engagement with our communications and website, and carry out surveys and feedback activities.

We will only send you marketing communications where we are allowed to do so by law and you can opt out at any time.

Where we run surveys or wellbeing questionnaires, we generally analyse responses at group level and, where possible, in anonymised or aggregated form. We will not share identifiable individual responses with employers unless this has been clearly explained and we have your explicit consent.

Lawful bases:

– Consent (for certain electronic marketing)

– Legitimate interests

Our legitimate interests are to promote our initiatives and services, keep you informed about relevant news and opportunities, understand engagement with our communications and website, carry out proportionate surveys and feedback activities, and segment our audience so we can send more relevant information while respecting your preferences and opt-outs.

You have the right to object at any time to the use of your information for direct marketing.

4.6 Dealing with queries, complaints or claims

We use your information to manage our relationship with you and others who contact us, investigate and respond to queries, concerns or complaints, learn from feedback so we can improve our services, keep appropriate records of complaints, incidents and claims, and establish, exercise or defend legal claims.

Lawful bases:

– Legitimate interests

– Legal obligation (in some cases)

Our legitimate interests are to manage our relationship with you, investigate and respond properly to issues raised, improve our services based on feedback and learning, keep records of complaints and incidents, and protect our legal position where necessary.

5. How long we keep information

We keep personal information only for as long as it is needed for the purposes set out in this privacy notice, and in line with our internal retention schedule and any legal or regulatory requirements.

The exact retention period will depend on the type of information and the reason we are using it. Broadly, we keep information for the following periods:

Type of record / Typical retention period / Reason:

– Care, support, nomination and wellbeing records – 7 years after the end of the relationship – To provide safe support, respond to queries and meet regulatory expectations

– Safeguarding records – 15 years after closure of the case – To protect individuals and comply with safeguarding guidance

– Complaint, incident and claim files – 7 years after closure – To respond to further queries and manage or defend legal claims

– Survey and research data – For as long as needed for anonymised analysis, then retained only in anonymised or aggregated form – To understand trends and impact without identifying individuals

– Recruitment records (unsuccessful candidates) – 6–12 months after the decision – To demonstrate fair recruitment and respond to questions or legal claims

– Employment records (staff) – 7 years after employment ends – To meet employment, tax and pension obligations and manage claims

– Marketing contact details and preferences – Until you withdraw consent or object, or we identify that the details are out of date – To keep in touch about our work and initiatives

– Financial Records – 7 years – To meet financial obligations placed on us and manage our financial reporting

For more specific information about how long we keep different types of personal information, please contact us using the details provided above.

6. Who we share information with

We share personal information only when it is necessary, appropriate and lawful to do so.

6.1 Our data processors

These organisations act on our instructions and do not use your information for their own purposes.

Heritage Oaks Healthcare Limited – Provides services such as staff training, recruitment and HR records, and may assist with accounting records.

SMH Haywood & Co Limited – Provides payroll and related accounting services.

Kristina Rutherford Consulting Ltd – Provides and maintains the platform that our app runs on. They host the system and may access it occasionally to resolve technical issues or carry out maintenance. They do not decide what data is collected or who has access and only act on our instructions.

Airtable – Provides cloud-based database and workflow tools to help us manage our services and communications.

Softr – Provides the no-code platform used to build and run parts of our app and website.

Email service provider (for example, Mailjet/Mailchimp) – Sends service emails and, where you have opted in, marketing updates on our behalf.

IT support and hosting providers – Provide technical support, hosting and security services to keep our systems up to date and secure.

Seb Kane – Provides wellbeing coaching and related support services to individuals and groups on our behalf. They may access limited personal information (such as names, contact details and relevant wellbeing information) needed to deliver these services. They do not use this information for their own purposes and only act on our instructions.

Viktoria Garbett – Provides nutrition and wellbeing services, including workshops and coaching sessions, to support our initiatives. They may access limited personal information needed to deliver these services (for example names, contact details and relevant dietary or wellbeing information) and only act on our instructions.

Palms Row Healthcare Limited – Helps us with processing payments and financial management information. They may have access to personal and financial details needed to administer payments and reconcile accounts, and only use this information as instructed by us.

BrightPay (payroll software provider) – Provides the software we use to run our payroll. Where we use BrightPay’s cloud services, payroll data is stored and backed up on BrightPay’s remote servers, which are hosted on their chosen cloud infrastructure. BrightPay only processes payroll data as necessary to provide their services to us and does not use it for their own purposes.

Xero – Provides cloud-based accounting software that we use to manage our accounts and financial records. Personal information (for example names and contact details linked to invoices or payments) may be stored in Xero’s systems and processed only in line with our instructions and Xero’s data protection safeguards.

Sage – Provides accounting and/or payroll software used to manage parts of our financial administration. Personal information contained in accounting records may be stored in Sage systems and processed only as necessary to provide their services to us and in line with our instructions.

Google (Google Forms / Google Workspace) – Provides online form and productivity tools we may use to collect and store form and survey responses. In this context, Google processes personal data on our behalf as our data processor and does not use this information for its own purposes.

We have contracts in place with our data processors that require them to keep your information secure and to use it only as instructed by us.

6.2 Other organisations we may share personal information with

Where relevant, and where we have a lawful basis, we may also share information with:

– Other health or care providers (for example, GPs and consultants)

– Insurance companies, brokers and other intermediaries

– Charities and voluntary organisations

– Care providers and social care employers (for example, in connection with nominations or anonymised group feedback)

– Councils and other public sector organisations

– Regulatory authorities and ombudsmen

– Professional advisers (such as legal or financial advisers)

– Law enforcement and other authorities where required by law

– Banks and payment providers, such as NatWest Bankline, to make and receive payments. NatWest acts as an independent data controller for the payment and account information it processes and uses your information in line with its own privacy notice.

– Analytics, spam detection and website service providers such as Google Analytics, Akismet, Gravatar, WordPress and related plugins, as described in section 2.7. In these cases, these providers typically act as independent data controllers and use the data in line with their own privacy policies.

We will not sell your personal information.

7. Sharing information outside the UK

Some of our data processors (for example, cloud service providers) may be based outside the UK, or may store data on servers outside the UK.

Where we transfer personal information outside the UK, we will ensure that appropriate safeguards are in place, such as:

– Adequacy regulations made by the UK government; or

– Approved standard contractual clauses or international data transfer agreements; or

– Other measures permitted under UK data protection law.

Where necessary, our data processors may also share personal information outside the UK. When they do, they must comply with the UK GDPR and ensure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguards, please contact us using the contact information provided above.

8. Your data protection rights

Under UK data protection law, you have a number of rights in relation to your personal information. These may depend on the lawful basis we rely on and the specific circumstances.

Your rights include:

– Your right of access – You have the right to ask us for copies of your personal information.

– Your right to rectification – You have the right to ask us to correct the personal information you think is inaccurate or incomplete.

– Your right to erasure – You have the right to ask us to delete your personal information in certain circumstances.

– Your right to restriction of processing – You have the right to ask us to limit how we use your personal information in certain circumstances.

– Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances, including for direct marketing.

– Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

– Your right to withdraw consent – Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdrew your consent.

You are not required to pay any charge for exercising your rights. If you make a request, we will normally respond within one month.

To exercise any of these rights, please contact us using the details at the top of this privacy notice.

9. How to complain

If you have any concerns about our use of your personal data, you can:

– Contact us using the contact details at the top of this privacy notice, so we can try to resolve your concern; and

– If you remain unhappy, you can also complain to the Information Commissioner’s Office (ICO).

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: www.ico.org.uk

10. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes in our activities or the law. The most up-to-date version will always be available on our website or on request.

Last updated: 4/12/2025