Privacy Policy

Introduction
This Privacy Policy explains how we collect, process, store, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to:

  • Your use of our website;
  • Applications for employment with us;
  • Your employment with us;
  • The provision of our services as a registered care provider;
  • Any enquiries you submit to us.

You should read this policy carefully to understand how we handle your personal data. We are committed to using and storing your personal data only in ways that are lawful, secure, and transparent.

Who We Are

We are ubu, registered as Northern Life Care Limited, based at Windsor House, Cornwall Road, Harrogate HG1 2PW. Our company registration number is 1867042.

We are registered with the Information Commissioner’s Office (ICO) under registration number Z5042255.

For any queries regarding this Privacy Policy or the processing of your personal data, please contact us at dataprotection@ubu.me.uk.

What Personal Data We Collect

Personal data refers to any information relating to an identifiable person. The type of personal data we collect depends on your relationship with us and may include:

Data Subject Types of Personal Data
Website Visitors Information collected via cookies (see our Cookie Policy).
Job Applicants & Employees Name, address, contact details, email, National Insurance number, employment and education history, criminal record declarations, health data, proof of identity and right to work documents.
Individuals Making Enquiries Name, contact details, and details of the enquiry.
Service Users Name, contact details, NHS number, equality data, criminal convictions, medical records, medication, personal history, needs assessments, and support plans.
Related Persons (e.g. Family of Service Users or Employees) Name, address, telephone number, email address.
Professionals Working with Us Name, contact details, business details.

How We Collect Personal Data

We may collect personal data from:

  • Direct interactions (e.g., job applications, employment records, enquiries, service provision);
  • Third parties, including previous employers, referees, Local Authorities, Clinical Commissioning Groups, and healthcare providers;
  • Website interactions (via cookies and analytics tools);
  • CCTV recordings in certain locations;
  • Wi-Fi networks (non-identifiable device data for security purposes, stored for up to 1 month).

How We Use Your Personal Data

We will only process your personal data when we have a lawful basis to do so, including:

Purpose of Processing Legal Basis for Processing
To provide and improve our website Legitimate interests (ensuring website functionality and user experience)
Processing job applications Performance of a contract; Legal obligation (safeguarding & employment regulations)
Managing employment relationships Performance of a contract; Legal obligations (e.g., payroll, pensions, tax)
Responding to enquiries Legitimate interests (providing information about our services)
Providing support services Performance of a contract; Legal obligation; Legitimate interests (ensuring quality care)
Safeguarding and protecting individuals Legal obligation; Vital interests (UK GDPR Article 6(1)(d))

Where we process special category data (e.g., health data, criminal records), we will do so under Article 9(2) of UK GDPR and the relevant provisions of Schedule 1 of the Data Protection Act 2018.

We do not use personal data for direct marketing purposes.

How We Store and Protect Your Data

We take reasonable and up-to-date security measures to:

  • Keep your data secure;
  • Prevent unauthorised access, loss, or misuse;
  • Restrict access to only those who need it for their roles.

Data is stored on secure servers and in encrypted filing systems. If data breaches occur, we have procedures in place to mitigate risks and notify affected individuals where required.

How Long We Keep Your Data

We will not retain your personal data for longer than necessary. Examples of retention periods include:

  • Unsuccessful job applications – retained for 12 months, then deleted;
  • Employment records – retained for up to 6 years post-employment;
  • Service user records – retained for as long as required by regulatory obligations.

For further details on retention periods, contact dataprotection@ubu.me.uk.

Your Rights Under UK GDPR

You have the right to:

  • Access your personal data;
  • Rectify inaccurate or incomplete data;
  • Request erasure of your data (where legally applicable);
  • Restrict processing of your data under certain circumstances;
  • Object to processing based on legitimate interests;
  • Request data portability;
  • Withdraw consent where processing is based on consent.

To exercise your rights, contact dataprotection@ubu.me.uk. We may require identity verification to process your request.

Who We Share Your Data With

We may share personal data with third parties where legally required or necessary for service delivery, including:

  • Regulatory bodies (e.g., CQC, HMRC, ICO);
  • Service providers (e.g., payroll providers, pension providers, DBS check providers);
  • Healthcare professionals and Local Authorities for service users’ care;
  • Law enforcement or safeguarding authorities where required.

All third parties must comply with UK GDPR and contractual data protection agreements.

International Data Transfers

We do not transfer personal data outside the UK unless:

  • There is an adequacy decision ensuring equivalent data protection standards;
  • Appropriate contractual safeguards (e.g., UK IDTAs) are in place;
  • You have given explicit consent to the transfer.

CCTV and Wi-Fi Data

Some of our locations use CCTV for security and safeguarding purposes. Notices are displayed where CCTV is in operation. Footage is retained for up to 30 days unless required for investigations.

Our Wi-Fi system may collect non-identifiable data about connected devices for network security purposes, retained for 1 month.

Cookies and Website Data

Our website uses cookies to enhance user experience. See our Cookie Policy for details on types of cookies used and how to manage preferences.

Your Right to Complain

If you have concerns about our data processing, contact us at dataprotection@ubu.me.uk. If unresolved, you may lodge a complaint with the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/.

Updates to This Policy

We reserve the right to amend this policy as necessary. Changes will be published on our website.

Last updated: 3rd February 2025