Privacy Policy

GRACE & GOODWILL LTD PRIVACY POLICY

1. INTRODUCTION

1.1. Grace & Goodwill Ltd ("Grace & Goodwill", "we", "our" or "us") is committed to protecting the privacy and security of the personal data entrusted to us. This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when individuals access or use our website, Platform or Agency Services, communicate with us or otherwise interact with Grace & Goodwill. It also explains the rights available to individuals in relation to their personal data and how those rights may be exercised.

1.2. This Privacy Policy applies to personal data relating to Clients, prospective Clients, Care Workers, prospective Care Workers, authorised representatives, emergency contacts, website visitors and any other individuals whose personal data we process in connection with our business. It covers personal data collected through our website, Platform, registration processes, communications, compliance and verification procedures, payment administration and any other interaction with our Agency Services.

1.3. Grace & Goodwill operates as an independent introductory agency and online Platform facilitating Introductions between Clients and self-employed Care Workers. We do not provide, supervise or manage care services. Personal data is processed solely for the purposes described in this Privacy Policy, including facilitating Introductions, administering the Platform and Agency Services, verifying Care Worker eligibility and compliance, administering payments where applicable, maintaining Platform security and complying with legal obligations.

1.4. Grace & Goodwill processes personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable data protection laws. We are committed to processing personal data fairly, lawfully and transparently, using appropriate technical and organisational measures to safeguard that information throughout its lifecycle. Where additional privacy information is provided for a particular service or activity, it shall supplement this Privacy Policy to the extent applicable.

2. WHO WE ARE

2.1. Grace & Goodwill Ltd ("Grace & Goodwill", "we", "our" or "us") is a company incorporated and registered in England and Wales under company number 16011465, with its registered office at Hypoint, Saltmeadows Road, Gateshead, NE8 3AH, United Kingdom. For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Grace & Goodwill is the data controller in relation to the personal data processed through our Website, Platform, and Agency Services.

2.2. If you have any questions about this Privacy Policy, wish to exercise your rights under applicable data protection laws, or would like to contact us regarding the processing of your personal data, you may do so using the details below: Grace & Goodwill Ltd Email: admin@graceandgoodwill.co.uk Registered Office: Hypoint, Saltmeadows Road, Gateshead, NE8 3AH, United Kingdom

2.3. Grace & Goodwill has not appointed a statutory Data Protection Officer. All enquiries, requests and notices relating to data protection or this Privacy Policy should be directed to: admin@graceandgoodwill.co.uk, and we will respond in accordance with applicable data protection laws.

3. PERSONAL DATA WE COLLECT

3.1. The personal data we collect depends on how you interact with Grace & Goodwill and the Agency Services you request or provide. We may collect personal data from Clients, prospective Clients, Care Workers, prospective Care Workers, authorised representatives, emergency contacts, website visitors and other individuals who communicate or otherwise interact with us.

3.2. We collect only the personal data that is reasonably necessary to provide our Agency Services, comply with our legal and regulatory obligations, protect the safety and integrity of our Platform, administer our business and exercise or defend our legal rights. Where we are required by law or where certain information is necessary to provide our Agency Services, failure to provide the requested information may prevent us from providing or continuing those services.

3.3. The categories of personal data we may collect include, but are not limited to, the following:

- Personal Identification Information: Full name, title, date of birth, gender, nationality, profile photograph, account identifiers and membership or Placement reference numbers. - Contact Information: Residential address, correspondence address, email address, telephone number, emergency contact details and preferred communication method. - Client and Care Recipient Information: Care requirements, daily routines, accommodation arrangements, personal preferences, household information, preferred commencement dates and Placement information. - Health and Care Information: Medical conditions, diagnoses, disabilities, allergies, medication, mobility requirements, falls risks, dietary requirements, communication needs, behavioural information, specialist equipment and GP or hospital information. - Identity Verification Information: Passport, driving licence, proof of address, Right to Work documentation and identity verification records. - Professional Information: Employment history, qualifications, professional registrations, references, mandatory and specialist training, skills, experience and Placement preferences. - Care Worker Compliance Information: Enhanced DBS status, DBS Update Service status, Public Liability Insurance, Professional Indemnity Insurance (where applicable), safeguarding records, driving information and compliance documentation. - Financial and Payment Information: Membership Fees, Agency Fees, Care Fees, invoices, payment records, bank details, refunds and transaction history. - Complaints and Safeguarding Information: Complaints, safeguarding notifications, fraud reports, Platform misuse reports and Platform suitability records. - Communications: Emails, messages, telephone notes, enquiries and correspondence. - Uploaded Content: Documents, photographs, profile information, biographies, certificates and uploaded files. - Technical Information: IP address, browser type, device information, cookies, login information and Website usage information. - Marketing Preferences: Marketing consents, communication preferences and subscription preferences.

4. HOW WE COLLECT PERSONAL DATA

4.1. We collect personal data directly from you when you access or use our Website or Platform, contact us, create an account, submit an enquiry, register as a Client or Care Worker, complete application or onboarding forms, upload documents, subscribe to our communications or otherwise interact with our Agency Services.

4.2. We may also collect personal data from third parties where this is necessary to provide our Agency Services or comply with our legal obligations. Depending on the circumstances, this may include identity verification providers, Disclosure and Barring Service (DBS) providers, right to work verification providers, referees, professional bodies, training providers, insurers, payment service providers, publicly available sources, authorised representatives and any other third party whom you have authorised to provide information to us.

4.3. We may also receive personal data from Family Members, authorised representatives acting on behalf of a Client, referees, previous employers, professional bodies, training providers, insurers, identity verification providers, Right to Work verification providers, payment service providers and other third parties where reasonably necessary to facilitate the Agency Services, verify information, maintain Platform compliance or comply with applicable legal obligations.

4.4. In addition, certain technical information is collected automatically when you visit our Website or use our Platform through cookies, server logs and similar technologies. Further information about our use of cookies and similar technologies is available in our Cookie Policy.

5. HOW WE USE PERSONAL DATA AND OUR LAWFUL BASIS

5.1. Grace & Goodwill processes personal data only where there is a lawful basis to do so under the UK General Data Protection Regulation ("UK GDPR"). The lawful basis relied upon will depend on the nature of the personal data concerned, the purpose for which it is processed and the relationship between Grace & Goodwill and the individual whose personal data is being processed.

5.2. The principal purposes for which we process personal data, together with the corresponding lawful bases, are set out below: - Responding to enquiries: Identification, contact and communications information. Lawful Basis: Pre-contractual Steps; Legitimate Interests. - Registering Users and creating Accounts: Identification, contact, identity verification and Account information. Lawful Basis: Contract; Legitimate Interests. - Reviewing care requirements and facilitating Introductions: Identification, care requirement, health and communications information. Lawful Basis: Contract; Legitimate Interests. - Maintaining Client and Care Worker profiles: Identification, professional and uploaded information. Lawful Basis: Contract. - Verifying identity, Right to Work, DBS, qualifications, insurance and training: Professional and compliance information. Lawful Basis: Contract; Legal Obligation (where applicable); Legitimate Interests. - Facilitating communications: Contact, communications and Placement information. Lawful Basis: Contract. - Administering Membership Fees, Agency Fees, Care Fees and payment administration: Financial and payment information. Lawful Basis: Contract; Legal Obligation. - Maintaining accounting and business records: Financial information. Lawful Basis: Legal Obligation. - Receiving complaints and safeguarding notifications: Complaints, safeguarding and communications information. Lawful Basis: Legitimate Interests; Legal Obligation (where applicable). - Determining continued Platform eligibility: Professional, compliance and complaints information. Lawful Basis: Legitimate Interests. - Preventing fraud and maintaining Platform security: Technical and Account information. Lawful Basis: Legitimate Interests. - Marketing communications: Contact information and marketing preferences. Lawful Basis: Consent or Legitimate Interests. - Legal claims and compliance: Any relevant personal data. Lawful Basis: Legitimate Interests; Legal Obligation.

6. SPECIAL CATEGORY DATA

6.1. Certain personal data processed by Grace & Goodwill may constitute special category data under the UK General Data Protection Regulation ("UK GDPR"), including information relating to an individual's health, medical conditions, disabilities, care requirements, accessibility needs or other sensitive personal information voluntarily provided in connection with the Agency Services. We process such information only where it is reasonably necessary for the purposes described in this Privacy Policy and where an appropriate lawful basis and condition for processing applies under applicable data protection laws.

6.2. Where special category data is processed, Grace & Goodwill implements appropriate safeguards to protect its confidentiality, integrity and security. Access to such information is restricted to those individuals who require it for legitimate business, safeguarding or legal purposes, and we take reasonable steps to ensure that only the minimum amount of information necessary for the relevant purpose is processed. Where Grace & Goodwill processes criminal offence data, including DBS information or related verification records, such processing is carried out only where permitted by applicable law and subject to appropriate safeguards.

6.3. Grace & Goodwill may also process criminal offence information, including Enhanced DBS information, safeguarding concerns and related compliance records where permitted by applicable law and reasonably necessary to determine continued Platform eligibility, protect Users, comply with legal obligations or establish, exercise or defend legal claims. Where appropriate, Grace & Goodwill will ordinarily retain verification records rather than full DBS certificates.

6.4. Individuals are not required to provide special category data unless it is reasonably necessary for the provision of the Agency Services or required by law. Where such information is not provided, Grace & Goodwill may be unable to facilitate certain Introductions, verify suitability for Placements or otherwise provide the requested Agency Services.

7. SHARING PERSONAL DATA

7.1. Grace & Goodwill may share personal data with third parties where this is reasonably necessary to provide the Agency Services, comply with legal or regulatory obligations, protect our legitimate business interests or where you have otherwise authorised or requested us to do so. We do not sell personal data and will not disclose it for unrelated commercial purposes.

7.2. Grace & Goodwill may disclose personal data, where reasonably necessary, to: a. prospective or engaged Clients and Care Workers for the purpose of facilitating an Introduction or Care Arrangement; b. payment processors, banks and financial institutions; c. identity verification, Right to Work and DBS verification providers; d. referees, previous employers, professional bodies and training providers; e. insurers; f. cloud hosting, information technology and Platform service providers; g. accountants, solicitors, auditors and other professional advisers; h. regulators, safeguarding authorities, law enforcement agencies and courts where required by law; i. any successor organisation in connection with a business transfer; and j. any other person where the individual has authorised or requested the disclosure.

7.3. Grace & Goodwill may also receive complaints, protection notifications or compliance information concerning a Care Worker. Such information shall be processed solely for Platform administration, determining continued eligibility for Platform registration, complying with legal obligations and protecting Users. Such processing does not mean that Grace & Goodwill supervises or manages the delivery of care services.

7.4. Where we engage third-party service providers to process personal data on our behalf, they are required to process that information only in accordance with our instructions, maintain appropriate security measures and comply with applicable data protection laws. We take reasonable steps to ensure that any third party receiving personal data provides an appropriate level of protection consistent with the requirements of the UK GDPR and the Data Protection Act 2018.

8. INTERNATIONAL TRANSFERS OF PERSONAL DATA

8.1. Grace & Goodwill primarily stores and processes personal data within the United Kingdom. However, in certain circumstances, personal data may be transferred to, stored in or accessed from countries outside the United Kingdom where this is necessary to provide the Agency Services, engage trusted service providers or comply with applicable legal obligations.

8.2. Where personal data is transferred internationally, Grace & Goodwill will take appropriate steps to ensure that the information continues to receive an adequate level of protection in accordance with the UK GDPR. Such safeguards may include transfers to countries that have been recognised by the UK Government as providing an adequate level of data protection, the use of approved contractual safeguards, or any other lawful transfer mechanism permitted under applicable data protection legislation.

8.3. Where you require further information regarding the safeguards applied to international transfers of your personal data, you may contact Grace & Goodwill using the contact details set out in this Privacy Policy.

8.4. Where personal data is transferred outside the United Kingdom, Grace & Goodwill shall ensure that the transfer is protected by an appropriate safeguard recognised under applicable data protection legislation, including an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

9. DATA SECURITY

9.1. Grace & Goodwill is committed to protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access. We implement appropriate technical and organisational measures designed to safeguard personal data throughout its lifecycle, taking into account the nature of the information processed, the risks involved and the requirements of applicable data protection laws.

9.2. Our security measures may include access controls, password protection, encryption where appropriate, secure hosting environments, system monitoring, data backup procedures, restricted access to personal data, staff confidentiality obligations and other safeguards intended to maintain the confidentiality, integrity and availability of personal data. Access to personal data is limited to individuals who require it to perform their authorised duties and who are subject to appropriate confidentiality obligations.

9.3. Although we take reasonable steps to protect personal data, no method of transmitting information over the internet or storing information electronically can be guaranteed to be completely secure. Individuals who use our Website or Platform are responsible for maintaining the confidentiality of their account credentials and should notify Grace & Goodwill immediately if they believe their account or personal information has been compromised.

10. DATA RETENTION

10.1. Grace & Goodwill retains personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, comply with applicable legal, regulatory, accounting and safeguarding obligations, resolve disputes, enforce our legal rights and meet our legitimate business requirements. Once personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our internal retention procedures.

10.2. The table below sets out the standard retention periods applied by Grace & Goodwill. These periods may be extended where necessary to comply with legal obligations, ongoing investigations, safeguarding requirements or the establishment, exercise or defence of legal claims. - Payment and accounting records: Six (6) years following the end of the relevant financial year or longer if required by law. - Care Worker compliance records: Duration of registration plus six (6) years unless a longer period is required by law. - DBS verification records: Only for so long as reasonably necessary to evidence verification, in accordance with applicable law and guidance. - Complaints and safeguarding records: For so long as reasonably necessary to resolve the matter, protect Users or comply with legal obligations.

11. YOUR RIGHTS

11.1. Subject to applicable data protection laws, you may have certain rights in relation to the personal data that Grace & Goodwill holds about you. These rights are not absolute and may be subject to legal exemptions or limitations depending on the circumstances of the request.

11.2. Depending on the circumstances, you may have the right to request access to your personal data, request that inaccurate or incomplete personal data be corrected, request the deletion of personal data, request that the processing of your personal data be restricted, object to certain processing activities, request the transfer of your personal data to another organisation where technically feasible, or withdraw your consent where processing is based on consent. You also have the right not to be subject to a decision based solely on automated processing where such a right applies under applicable law.

11.3. If you have concerns regarding our processing of your personal data, we encourage you to contact Grace & Goodwill first so that we may investigate and attempt to resolve the matter. This does not affect your right to lodge a complaint with the Information Commissioner's Office or any other competent supervisory authority.

11.4. If you wish to exercise any of your rights, please contact Grace & Goodwill using the contact details set out in this Privacy Policy. We may request information to verify your identity before responding to your request and will respond within the timeframes required by applicable data protection laws. If you believe that your personal data has been processed unlawfully, you also have the right to lodge a complaint with the Information Commissioner's Office ("ICO"), although we encourage you to contact us first so that we have the opportunity to address your concerns.

12. COOKIES AND SIMILAR TECHNOLOGIES

12.1. Grace & Goodwill uses cookies and similar technologies to operate, maintain and improve the functionality, security and performance of our Website and Platform. These technologies may also be used to remember user preferences, analyse Website usage, enhance the user experience and, where permitted by law, support marketing and advertising activities.

12.2. You may manage or disable certain cookies through your browser settings or any cookie preference tools made available on our Website. Please note that disabling certain cookies may affect the functionality or performance of parts of the Website or Platform.

12.3. Further information about the cookies we use, the purposes for which they are used and the choices available to you is set out in our separate Cookie Policy, which should be read together with this Privacy Policy.

13. CHANGES TO THIS PRIVACY POLICY

13.1. Grace & Goodwill may amend or update this Privacy Policy from time to time to reflect changes in our Agency Services, legal or regulatory requirements, operational practices or the manner in which we process personal data. Any revised version will become effective from the date of publication unless otherwise stated.

13.2. Where a change materially affects the way in which personal data is processed, we will take reasonable steps to bring the updated Privacy Policy to the attention of affected individuals where required by applicable law. Your continued use of our Website, Platform or Agency Services following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms to the extent permitted by law.

13.3. We encourage you to review this Privacy Policy periodically to remain informed about how Grace & Goodwill protects and processes personal data.

14. CONTACT US AND COMPLAINTS

14.1. If you have any questions about this Privacy Policy, wish to exercise your rights under applicable data protection laws or have concerns regarding the way in which Grace & Goodwill processes your personal data, please contact us using the details set out in Section 2 (Who We Are). We will consider and respond to your enquiry as promptly as reasonably practicable and within the timeframes required by applicable law.

14.2. If you are dissatisfied with our response or believe that your personal data has been processed in breach of applicable data protection laws, you have the right to lodge a complaint with the Information Commissioner's Office ("ICO"), the United Kingdom's independent supervisory authority for data protection. Information about the complaints process is available on the ICO's website at www.ico.org.uk, although we encourage you to contact Grace & Goodwill first so that we have the opportunity to resolve your concerns.