ADULT CARE CONSULTANCY PRIVACY NOTICE

 

 

DATA PROCESSOR – (Instructing Parties including their Clients)

 

This notice explains how Adult Care Consultancy (‘ACC’) processes personal data when acting as a Data Processor. This includes data received from our Instructing Parties (our direct customers, such as Local Authorities or Solicitors) and their Clients (the individuals who are the subject of the assessments/consultations). Throughout this notice, both Instructing Parties and their Clients may be referred to as ‘you’ or ‘your’.

​

Clients of Instructing Parties: If you are an individual whose data has been provided to us by an Instructing Party (e.g., a Local Authority or Solicitor), please refer to your Instructing Party’s privacy notice for comprehensive details on how they, as the Data Controller, handle your personal data.

​

Our Data Controller Privacy Notice: Where ‘ACC’ processes personal data as a Data Controller (e.g., personal data collected directly from visitors to our website, individuals making direct enquiries not via an instructing party, or our employees), please refer to our separate Data Controller Privacy Notice. This notice includes details on how we use personal data collected when you use our website or engage with us directly outside of an instructed assessment.

​

This Privacy Notice will be updated periodically to reflect changes in our practices or legal requirements. The most up-to-date version will always be available on our website at www.adultcareconsultancy.com and becomes effective immediately upon publication.

Last updated on: 29 June 2025

 

1. Introduction

 

Welcome to the Adult Care Consultancy (‘ACC’) Privacy Notice. ‘ACC’ is a provider of independent adult social care assessments and consultancy services.

​

‘ACC’ takes data protection seriously and is committed to respecting and protecting your personal data. Personal data is any information ‘relating’ to an identified or identifiable person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

​

For the purposes of this Privacy Notice, “Data Protection Legislation” means all applicable data protection and privacy legislation in force from time to time in the UK including without limitation the UK General Data Protection Regulation (UK GDPR) as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018 or any successor legislation.

​

This Privacy Notice explains how we will collect, store and use any personal data you (as an Instructing Party or their Client) provide to us in the course of the services we provide as a Data Processor.

​

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

​

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance. Please note that as we are acting on behalf of the Instructing Party in our role as a Data Processor, any communications to the ICO regarding your data would typically need to be made through the Data Controller (your Instructing Party). We, of course, would fully co-operate in any investigation.

​

If you have any questions you can contact us at:

• Email: adult-care-consultancy@outlook.com

• ICO Registration Number: [updated when needed]

 

2. The Data We May Collect About You

 

We will collect, or be provided with, and process information about you, your personnel, and clients through various means, including:

• In the course of carrying out assessment or consultancy work for you (or your Instructing Party), in which case we will process any of your client's personal data provided to us as a Data Processor as defined in the Data Protection Legislation.

• By email or other electronic correspondence.

• By telephone.

• Postal correspondence.

• Otherwise through providing our services or operating our business.

• ​

The personal data we may be provided with or collect includes:#

• Your (Instructing Party's) Name and Title: For professional contact.

• Contact Information: Including telephone number(s), postal address, and email address.

• Information relating to your location: If relevant to the service delivery.

• Photographic Identification: If required for identity verification by the Instructing Party.

• With respect to Clients (of Instructing Parties): Their personal data (such as contact details, date of birth, name) including special categories of personal data (such as detailed background information, comprehensive health records, medical history, care needs assessments, mental capacity assessments, family information relevant to care, financial details related to care funding, and case bundles).

• Any other personal data we collect (such as customer and client reference numbers which will be assigned to you) in the context of providing our services or in the course of operating our business.

​

Please note: If you contact us by phone, your conversation may be recorded for training, quality assurance, and record-keeping purposes.

​

The personal data described above may relate to any of the following categories of person:

• You (the Instructing Party).

• Clients of the Instructing Party.

• Relevant third parties involved in the client's care.

 

3. How We Use Your Information

 

As a Data Processor, we use your information solely on the instructions of the Data Controller (your Instructing Party) and in accordance with our contractual obligations to them. Our uses typically include:

• To complete our contractual obligations to your Instructing Party by delivering the requested adult social care assessments or consultancy services.

• To respond to any query that you (as an Instructing Party) may submit to us.

• To manage our relationship with you (and/or your Instructing Party), including by maintaining databases of customers and other third parties for administration, accounting, and relationship management purposes.

• Where it is necessary for our legitimate interests (e.g., for internal administrative purposes, quality assurance, or service improvement) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal or regulatory obligation (for example, any relevant safeguarding duties, professional body requirements, or anti-money laundering regulations).

 

4. Legal Grounds for Processing Your Information

 

As a Data Processor, we process your personal data on the instructions of your Instructing Party. Our own legal bases for processing, in addition to their instructions, are typically:

• Performance of a Contract: For the execution of our contractual arrangements with the Instructing Party, such as arranging appointments with Independent Adult Social Care Professionals or conducting assessments.

• Compliance with a Legal Obligation: To which we are subject (e.g., record-keeping requirements, safeguarding duties).

• Legitimate Interests: Where we have a legitimate interest in doing so as a service provider (e.g., for internal quality control, service development, or dispute resolution).

• For Special Category Data: Where processing of ‘special category data’ (such as health data) is necessary in the context of the establishment, exercise, and completion of adult social care assessments, the provision of health or social care, or for reasons of substantial public interest.

• Consent: In certain limited circumstances, where we have express consent to do so from the data subject (e.g., for non-essential communication or specific data sharing not covered by other legal bases). Where we rely on consent, we will explain that it may be withdrawn at any time in accordance with the information we provide at that time.

​

We will process your client’s personal data strictly as a Data Processor in accordance with the terms of the contractual arrangements in place between us and the Instructing Party.

 

5. Sharing Your Information

 

We will share your details with carefully selected third parties instructed by us in accordance with our contractual obligations to your Instructing Party and/or their Clients in the course of business. These may include:

• Our Independent Adult Social Care Professionals: Including Independent Social Workers, Occupational Therapists, Nurses, or other specialists who are conducting the assessments or providing consultancy services.

• Our Carefully Selected Service Providers: Who provide essential support such as IT and system administration services, secure data storage, secure communication platforms, and secure document shredding services. We ensure these providers are contractually bound to protect your data with appropriate safeguards.

• Instructing Party's Specific Requests: If your Instructing Party specifically requests disclosure, or it is necessary to provide our services to them.

• Legal Obligation: If we are under a duty to disclose or share your personal data in order to comply with any legal obligation (e.g., court order, safeguarding referral).

​

We do not sell your information.

 

6. What We Do to Protect Your Personal Data

 

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. These measures include:

• Access Controls: Limiting access to personal data to only those employees, agents, contractors, and other third parties who have a business need to know, and who are subject to a duty of confidentiality.

• Technical Safeguards: Utilising secure networks, encryption, firewalls, and robust data storage solutions.

• Organisational Policies: Implementing strict data protection policies, regular staff training, and incident response procedures.

​

In addition, we have put in place procedures to deal with any suspected personal data breach and, in the event of a breach, will notify your Instructing Party and any applicable regulator where we are legally required to do so.

 

7. Storage and Retention of Your Personal Data

 

We retain your personal data in line with our internal retention policies and guidelines. These have been developed to ensure our compliance with regulatory obligations and professional practice, particularly for adult social care records. The time periods vary depending on the particular circumstances and the nature of the data.

​

We will not store your information for longer than is reasonably necessary or required by law, and/or as needed for the duration of our contractual relationship with the Instructing Party. For adult social care records, we generally adhere to retention periods consistent with relevant NHS and Local Authority guidelines, which may be up to 8 years after the client's death or the cessation of services.

 

8. Sending Your Information Outside of the UK

 

Your information will be predominantly processed in the UK. If your information is transferred outside the UK or the European Economic Area (EEA), we will ensure that a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• The country has been deemed to provide an adequate level of protection for personal data by the UK government.

• Specific contracts approved by the UK government are used which give personal data the same protection it has in the UK.

• Where appropriate, other lawful mechanisms for international transfers are in place.

 

9. Your Information Rights

 

Data Protection Legislation gives individuals (data subjects) certain rights regarding their personal data. With respect to data we hold as a Data Processor for your Instructing Parties, any requests regarding these rights should primarily be directed to your Instructing Party (the Data Controller).

If we directly receive a request relating to your (or your client's) rights, we will:

• Notify your Instructing Party, as they are the Data Controller.

• Await their instructions on how to proceed.

• Co-operate fully with your Instructing Party in fulfilling any valid rights request.

​

If we are asked to process the information requests by your Instructing Party, we may ask for confirmation of identity so that we can validate the request. Individuals may make a request by email or writing to the contact details provided in Section 1.

​

Under Data Protection Legislation, individuals have the right to:

• Request access to their personal data and check that we are lawfully processing it.

• Request correction of the personal data that we hold about them if they consider that it is inaccurate.

• Request the transfer of their personal data to them or to a third party.

• Request erasure of their personal data. This includes where they have been successful in exercising their right to object to processing. However, we may not be able to comply with a request for erasure for specific legal reasons, which will be notified to them, if applicable, at the time of their request.

• Request restriction of processing of their personal data. This may be the case if they want us to establish the data’s accuracy or where our use of the personal data is unlawful but they do not want us to erase it.

• Object to processing of their personal data where we are relying on a legitimate interest and there is something about their particular situation which makes them want to object to processing on this ground, as they feel it impacts their fundamental rights and freedoms.

​

Where an individual exercises their rights to request erasure, or request a restriction in the processing of their personal data, or to object to processing of their personal data, we may still need to keep basic contact information about them if they are already, or will shortly be, an active customer of an Instructing Party, as this data will be required for contractual purposes.

​

We will not charge a fee for fulfilling these requests unless we feel the request is clearly unfounded or excessive (e.g., repeated requests), in which case we may either charge a reasonable fee or refuse to deal with the request.

Adult Care Consultancy 29/06/2025.​​