HCPA’s Privacy Statement
We’re committed to respecting and protecting your privacy
Who are HCPA?
Hertfordshire Care Providers Association (HCPA) is a not-for-profit membership organisation based in Welwyn Garden City that offers training, support, guidance, and business support services to Hertfordshire adult care providers.
Our purpose is to help care providers to raise the standard of adult social care across the county, with all adults who receive care experiencing a service of true quality, personalised to their needs. To achieve this, we work in close partnership with Hertfordshire County Council, Care Quality Commission, Clinical Commissioning Groups, Skills for Care, and other public bodies to help make positive changes in the Hertfordshire adult social care sector.
Many of the services we offer are fully funded by our health and social care partners, including Hertfordshire County Council, the NHS and other funding agencies, and this means that we are often able to deliver services free of charge, or at a very low-cost, to our members.
During the COVID-19 pandemic, we are assisting Hertfordshire County Council by operating a temporary workforce rescue service, providing temporary employment for emergency Care Staff requirements.
Why do we use your data?
Here at HCPA, we take your privacy seriously and will only use your information to help us manage your membership account with us, to share health and social care information with you from HCPA and our partners, to ensure you know about training development opportunities, and to successfully deliver our services to you.
During the COVID-19 pandemic, we may use the personal data of those registering for the workforce rescue service, to verify your employment status and provide key information about you to potential employers.
What type of data is stored?
The type of data that we collect from you could include; your name, organisation, contact details for your place of work, job title, payment details (for courses or related membership fees), business details (such as type of service, number of staff, number of service users), your previous HCPA activity (such as; events attended, courses booked or attended, membership status etc), any feedback you share with us, and any personal requirements you request when attending events or training courses booked through HCPA.
During the COVID-19 pandemic, the HCPA workforce rescue service may store personal information for up to 1 year. This data can include the above as well as DBS information, previous work histories, hours available to work, National Insurance numbers, home address and private contact details. We may also store contact details for professional references and referee contact details which are provided to us.
Who do we share data with?
We respond to information requests from our health and social care partners, approved training providers, and funders about our members and other care providers only when in relation to quality assurance and safeguarding purposes, and in order to successfully deliver training courses through our network of approved training providers.
We will not share or sell your data to commercial business third parties, such as our network of trusted strategic partners that offer business support services to our members, outside the above specification and we promise to keep your details safe and secure at all times.
HCPA Recruitment Team may share personal information with the data processor “Bullhorn” and during the COVID-19 pandemic, may share personal information with prospective employers, when registering for the workforce rescue service.
Under what legal basis do we collect / use / share your personal data?
Consent: We collect, hold and process your personal data on the basis that you have provided consent. You remain in control of the personal data you share with HCPA and can change your preferences at any time, by choosing whether you want to give consent to your data being processed for specific purposes. You can cancel your consent at any time and your details and information will be deleted, by sending an email to email@example.com.
Legitimate Interest: We may collect, hold and process your personal data on the basis of legitimate interest where it is necessary in order for us to fulfil our needs as a business and to be able to provide you with our services.
Vital Interest: We may use your personal information if we reasonably believe that there is any safety or health issue. This type of processing is in your vital interest.
Legal Obligation: We may use and process your personal data to comply with our legal obligations such as HMRC requirements, or if the Police or a local authority requests it.
Contract Law: We may process your personal data where it is necessary for the performance of a contract to which the data subject is party, or at the request of the data subject prior to entering the contract.
Medical: We may process your personal data where it is necessary for the purposes of preventative or occupational medicine and for other medical purposes, or for your protection when attending events / courses.
The following rights may apply to your personal data
The right to be informed
The right of access
You may request a copy of the personal data we hold about you free of charge. Once we have verified your identity and, if relevant, the authority of any third-party requestor, we will provide access to the personal data we hold about you as well as the following information:
The purposes of the processing
The categories of personal data concerned
The recipients to whom the personal data has been disclosed
The retention period or envisioned retention period for that personal data
When personal data has been collected from a third party, the source of the personal data
If there are exceptional circumstances that mean we can refuse to provide the information, we will explain them. If requests are frivolous or vexatious, we reserve the right to refuse them. If answering requests is likely to require additional time or unreasonable expense (which you may have to meet), we will inform you.
The right to rectification
When you believe we hold inaccurate or incomplete personal information about you, you may exercise your right to correct or complete this data. This may be used with the right to restrict processing to make sure that incorrect/incomplete information is not processed until it is corrected.
The right to erasure (the ‘right to be forgotten’)
Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data. This includes personal data that may have been unlawfully processed. We will take all reasonable steps to ensure your data is erased.
The right to restrict processing
You may ask us to stop processing your personal data. We will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies you may exercise the right to restrict processing:
The accuracy of the personal data is contested
Processing of the personal data is unlawful
We no longer need the personal data for processing but the personal data is required for part of a legal process
The right to object has been exercised and processing is restricted pending a decision on the status of the processing
The right to data portability
You may request your set of personal data be transferred to another controller or processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was on the basis of consent, the processing is by automated means, and if the processing is based on the fulfilment of a contractual obligation.
The right to object
You have the right to object to our processing of your data where:
- Processing is based on legitimate interest
- Processing is for the purpose of direct marketing
- Processing is for the purposes of scientific or historic research
- Processing involves automated decision-making and profiling
How can you alter or delete your data with us?
If you would like to stop receiving emails from us entirely you can simply click the unsubscribe link that can be found at the bottom of all of our email, or email firstname.lastname@example.org to ask to be removed from our distribution list. Please allow 72 hours for the changes to take effect. Please note: if you choose to unsubscribe from HCPA’s email database you will miss out on important alerts from our health and social care partners, fully funded training courses and events, relevant updates from the wider Hertfordshire health and social care network, and details of services included within your membership with us.