Privacy policy

Who we are

Involvement Services Limited is a company registered in England and Wales. Company number: 11549445. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We are the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO). Registration number: ZB562929.

We have not appointed a Data Protection Officer, as we are not required to. For any question about this policy or your personal data, contact us:

• Email: info@involvementservices.co.uk
• Telephone: 0333 301 0025
• Post: Data protection, Involvement Services Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Information we collect

Information you give us. When you complete our enquiry form, email, call or message us, we collect your name, organisation, job role if given, email address, telephone number, the type of service you run, the support you need, any deadline and how you would like us to contact you.

Information about your organisation. When we discuss or carry out work, we collect business contact details for owners, directors, managers and staff we work with, and information needed to deliver and invoice the work.

Information from other sources. We may check publicly available information about your organisation, such as Companies House records and published CQC or Ofsted reports, to understand your enquiry.

Website information. Our hosting provider keeps server logs, including IP address, browser type and pages requested, to keep the website secure and working. We do not use advertising or tracking cookies. See our Cookie policy.

Please do not send us information about people who use your service, or other sensitive information, through the website or by email. If agreed work requires it, we will agree a secure way to share it.

How we use it and why

Data protection law requires us to have a lawful basis for each use of personal data. The table below sets out what we use, why, and the basis we rely on.

Your right to object. Where we rely on legitimate interests, you can object at any time by contacting us. We do not send marketing emails. If we ever do, we will only send them where the law allows and every message will include a way to opt out.

We do not make decisions about you based solely on automated processing.

Information we handle during client work

Some work, such as quality audits, safeguarding reviews, record reviews or care management system setup, may involve access to records about people who use your service or your staff. This can include health and other special category information.

In that work, your organisation remains the controller and we act as your processor. We only use that information on your written instructions and for the agreed purpose, keep it confidential, and return or delete it when the work ends. The terms are set out in a data processing agreement as part of your contract with us.

Who we share it with

We do not sell personal data. We share it only where needed, with:

• Cognito Forms, which provides our enquiry form and stores form submissions on our behalf.
• Our website hosting provider, which stores the website and its server logs.
• Email, file storage and accounting providers that support our day-to-day business.
• Google Fonts, which delivers the fonts used on this website and receives your IP address when pages load.
• Professional advisers, such as accountants, insurers and lawyers, where needed.
• Regulators, the police or other authorities, where the law requires it or to protect someone’s safety.

Our service providers act on our instructions and under contracts that protect your data.

Transfers outside the UK

Some providers process data in the United States, including Cognito Forms and Google. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as providing adequate protection for certified organisations. Where another provider transfers data outside the UK, we make sure an adequacy decision or the UK International Data Transfer Agreement is in place.

How long we keep it

When information is no longer needed, we delete it securely.

How we protect it

We use appropriate technical and organisational measures to protect personal data, including secure passwords, encrypted connections and limiting access to people who need it. Our website uses a secure https connection. If a data breach is likely to put you at risk, we will tell you and the ICO where the law requires.

Your rights

You have the right to:

• be informed about how we use your personal data;
• ask for a copy of your personal data;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to our use of it;
• ask for information you gave us in a portable format; and
• withdraw consent at any time, where we rely on consent.

Contact us to use any of these rights. There is usually no charge. We may ask you to confirm your identity, and we will respond within one month, or tell you if we need longer for a complex request.

If we hold information about people using your service as your processor, we will pass any request we receive to you as the controller.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first using the contact details above. We will acknowledge your complaint within 30 days, look into it and let you know the outcome.

You also have the right to complain to the Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

Changes to this policy

We review this policy every year and whenever our practices change. The date at the top of this page shows when it was last reviewed.