We’re committed to respecting and protecting your privacy

1. Who we are

Hertfordshire Care Providers Association (HCPA) is a not-for-profit membership organisation based in Welwyn Garden City. We provide training, support, guidance, recruitment and business support services to adult social care providers across Hertfordshire and the rest of the UK. We are committed to respecting and protecting your privacy.

Our purpose is to help care providers raise standards in adult social care, so that adults who receive care experience services that are safe, effective, personalised and of high quality. To achieve this, we work in partnership with health and social care organisations and public bodies, including local authorities, the NHS, regulators, sector bodies, training providers and funders.

Many of the services we offer are funded by health and social care partners, including Hertfordshire County Council, the NHS and other funding agencies. This means we may be able to deliver services free of charge, or at a reduced cost, to members and care providers. Where funded services are provided, we may need to process and share relevant information for service delivery, reporting, quality assurance and safeguarding purposes.

2. What personal data we collect

We may collect and use the following types of personal data, depending on your relationship with HCPA and the services you use:

• Identity and contact data, such as name, job title, organisation, work address, email address and telephone number.
• Professional and organisational information, such as your role, service type, number of staff, number of service users, membership status and details about your organisation.
• Financial and transaction data, such as payment details relating to courses, events, membership or related services.
• Activity data, such as courses booked or attended, events attended, recruitment activity, membership records, enquiries, communications and service use.
• Feedback and survey responses that you choose to provide.
• Special category data, where relevant and necessary, such as accessibility requirements, dietary information linked to health needs, or information needed to support health, safety or safeguarding at events, training or other services.

3. How we collect your data

We collect personal data directly from you when you register with us, apply for membership, book training or events, contact us, use our services, provide feedback, respond to surveys, apply for recruitment support, or otherwise communicate with us.

We may also receive information from partner organisations, funders, approved training providers, local authorities, health and social care partners, employers or other relevant organisations where appropriate and lawful.

4. How we use your personal data

We use your personal data to:

• Manage your membership account and relationship with HCPA.
• Deliver training, events, recruitment, business support and other services.
• Provide relevant sector updates, health and social care information, service alerts, funded training opportunities and communications from HCPA and, where appropriate, our partners.
• Administer bookings, attendance records, payments, invoicing and related financial processes.
• Meet contractual, funding, quality assurance, safeguarding, monitoring and reporting obligations with partners and funders.
• Improve our services, communications and support to members and care providers.
• Comply with legal, regulatory, financial, safeguarding and governance obligations.

5. Lawful basis for processing

We rely on the following lawful bases under UK GDPR, depending on the purpose of the processing:

• Contract: to deliver membership services, training, events, recruitment support and other services you or your organisation have requested.
• Legitimate interests: to operate, administer, develop and improve HCPA services, maintain appropriate records, communicate with members and care providers, and support the adult social care sector. We will only rely on legitimate interests where those interests are not overridden by your rights and freedoms.
• Legal obligation: to meet legal, financial, regulatory, safeguarding, tax, accounting or reporting requirements.
• Vital interests: where processing is necessary to protect someone’s health, safety or wellbeing, including urgent health or safety situations.
• Consent: where you have provided clear permission, such as for certain communications or specific uses of special category data. You can withdraw consent at any time by contacting us.

Where we process special category data, such as health-related accessibility information, we will only do so where a relevant UK GDPR condition applies, such as explicit consent, employment/social care related obligations, safeguarding, or where processing is necessary to protect vital interests.

6. Who we share your data with

We may share personal data where necessary and lawful with:

• Approved training providers and delivery partners, so that training, events and related services can be delivered.
• Health and social care partners, funders, local authorities, NHS bodies, regulators and sector partners, where this is necessary for service delivery, funded-service reporting, quality assurance, safeguarding, monitoring or sector support purposes.
• IT system providers and data processors that support our systems and services, including Bullhorn where relevant to HCPA recruitment activity.
• Professional advisers, auditors, insurers and other organisations where required for governance, legal, financial or regulatory purposes.
• Public authorities, regulators, law enforcement bodies or safeguarding organisations where we are legally required to do so or where there is a valid safeguarding, legal or public interest reason.

We only share the minimum personal data necessary for the relevant purpose and require appropriate safeguards to be in place. We do not sell personal data.

We do not share personal data with commercial business third parties, including strategic partners that offer business support services, for their own marketing or commercial purposes unless this is clearly explained to you and a valid lawful basis applies, such as your consent where required.

7. International transfers

We do not routinely transfer personal data outside the UK. Where this occurs, we will ensure that appropriate safeguards are in place, such as an adequacy regulation, international data transfer agreement, standard contractual clauses or another lawful transfer mechanism.

8. How long we keep your data

We retain personal data only for as long as necessary to fulfil the purposes described in this notice and to meet legal, contractual, funding, regulatory, safeguarding, accounting and reporting obligations.

Retention periods depend on the type of data, the service provided, the applicable legal or funding requirements, and whether the information is needed for audit, reporting, safeguarding or dispute-resolution purposes. Further details are available on request.

9. Your data protection rights

You have the following rights under UK GDPR, subject to the conditions and exemptions set out in data protection law:

• Right to be informed: to receive clear information about how we use your personal data.
• Right of access: to request a copy of the personal data we hold about you, together with information about how it is used, who it is shared with and how long it is kept.
• Right to rectification: to ask us to correct inaccurate or incomplete personal data.
• Right to erasure: to ask us to delete personal data where there is no overriding lawful reason for us to continue holding it.
• Right to restrict processing: to ask us to limit how we use your personal data in certain circumstances, for example while accuracy or an objection is being considered.
• Right to data portability: to ask for certain personal data to be provided in a commonly used, machine-readable format, where this right applies.
• Right to object: to object to processing based on legitimate interests, to object to direct marketing, and to object to certain processing for research or profiling purposes.

To exercise any of these rights, please contact us using the details above. We may need to verify your identity before responding. In some circumstances we may be unable to comply with a request in full, for example where we need to retain information to meet legal, contractual, safeguarding, regulatory or funding obligations. If this applies, we will explain why.

10. Communications, preferences and unsubscribing

You can update your details and contact preferences at any time by emailing contact@hcpa.co.uk. Please let us know if your organisation’s contact person changes so that relevant information reaches the right people.

Where our emails include an unsubscribe link, you can use that link to stop receiving those communications. You can also email contact@hcpa.co.uk to ask to be removed from relevant distribution lists. Please allow up to 72 hours for changes to take effect.

If you unsubscribe from HCPA communications, you may miss important alerts from health and social care partners, funded training courses and events, relevant updates from the wider Hertfordshire health and social care network, and details of services included within your membership.

11. Complaints

If you are concerned about how we use your personal data, please contact us first so that we can try to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/

12. Security

We take appropriate technical and organisational measures to protect personal data. These may include secure systems, access controls, staff guidance, supplier due diligence, contractual safeguards, and working with trusted service providers.

13. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

14. Updates to this notice

We keep this privacy notice under regular review and will update it where necessary. The latest version will always be available on our website.