Privacy Policy

Who We Are

Mower's Ark CIC is a Community Interest Company registered in England and Wales. We provide day support services for adults with learning disabilities and other support needs. For the purposes of data protection law, Mower's Ark CIC is the data controller responsible for your personal data. Our registered address and contact details are provided at the end of this policy.

What Information We Collect

We may collect and process the following categories of personal information:

• Contact details — name, address, telephone number and email address
• Health and care information — relevant medical history, support needs, care plans and risk assessments
• Next of kin and emergency contact details
• Financial information — where relevant to funding or fee arrangements
• Employment information — for staff and volunteers, including DBS check results and references
• Website usage data — including IP address, browser type and pages visited, collected via cookies
• Enquiry and correspondence data — information you provide when contacting us

How We Use Your Information

We use your personal information for the following purposes:

• To provide and manage the care and support services you or your family member receives
• To communicate with you about our services, referrals and enquiries
• To fulfil our legal and regulatory obligations, including safeguarding duties
• To recruit, manage and support our staff and volunteers
• To improve our website and services through anonymised analytics
• To respond to complaints, feedback and subject access requests

Our Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR: performance of a contract or service agreement; compliance with a legal obligation (including safeguarding and employment law); protection of vital interests; and, where applicable, your explicit consent. Where we process special category data (such as health information), we rely on the additional condition of providing health or social care, or explicit consent.

How We Protect Your Data

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information against unauthorised access, loss, destruction or disclosure. These measures include secure storage of physical records, password-protected systems, restricted staff access on a need-to-know basis, and regular staff training on data protection responsibilities. We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law.

Sharing Your Information

We do not sell or rent your personal data to third parties. We may share your information with: local authorities and NHS bodies where required for care planning or safeguarding; regulatory bodies such as the Care Quality Commission; our insurers and legal advisers where necessary; and IT service providers who process data on our behalf under strict data processing agreements. All third parties are required to handle your data securely and in accordance with UK GDPR.

Cookies

Our website uses cookies to improve your browsing experience and to help us understand how visitors use our site. Cookies are small text files stored on your device. We use essential cookies (necessary for the site to function) and, where you have consented, analytics cookies to collect anonymised usage data. You can manage your cookie preferences through your browser settings at any time. Disabling cookies may affect the functionality of some parts of our website.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• The right to access — you can request a copy of the personal data we hold about you
• The right to rectification — you can ask us to correct inaccurate or incomplete data
• The right to erasure — you can ask us to delete your data in certain circumstances
• The right to restrict processing — you can ask us to limit how we use your data
• The right to data portability — you can request your data in a structured, machine-readable format
• The right to object — you can object to certain types of processing, including direct marketing
• The right to withdraw consent — where processing is based on consent, you may withdraw it at any time

Third-Party Services

Our website may contain links to third-party websites, including social media platforms such as Facebook. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies. Where we use third-party tools or platforms to deliver our services (for example, email or cloud storage providers), we ensure that appropriate data processing agreements are in place.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page indicates when the policy was last reviewed. We encourage you to check this page periodically. Continued use of our website or services after any changes constitutes acceptance of the updated policy.