PRIVACY POLICY

Empowered Solutions Limited (“Empower”, “we”, “us”, “our”) is committed to protecting your privacy and making sure you feel confident about how your personal information is used. This policy explains what information we collect, why we collect it, how we use it, and the rights you have. 

We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, which updates parts of UK GDPR and introduces new rights and responsibilities around digital transparency, data access, research and accountability

1. Who we are

• Empowered Solutions Limited trading as Empower

• Company number: 16947916

• Registered address: 105 High Street, Brentwood, Essex, CM14 4RR

• Trading address: The Hubb Business Centre, 335–351 Rainham Road South, Dagenham, RM10 8QR

• Email: info@empowerchoice.org.uk

We are a not‑for‑profit organisation supporting disabled adults and older people, their families, representatives, Personal Assistants (PAs) and social work professionals involved in Direct Payments. 

2. Who this policy covers

This policy applies to:

• People receiving support from Empower

• Relatives or representatives acting on someone’s behalf

• Personal Assistants (PAs) applying for roles, currently employed, or previously employed

• People using our online PA matching service

• Visitors to our website or digital tools

• Professionals and partners we work with

3. What personal information we collect

For people receiving support:

• Name, address, date of birth, contact details

• Proof of identity

• Health and care information

• Social care assessments and Direct Payment details

• Employment information (if you employ a PA)

• Financial information where needed

• Communication records

For Personal Assistants (PAs):

• Name, address, contact details

• Employment history and references

• Skills, training, qualifications

• Right to work documentation

• DBS certificate number and outcome

• Driving status

• Information provided during recruitment

• Payroll information (where relevant)

• Records of support we provide to you as a PA

We only collect what is necessary to support safe recruitment, employment, and ongoing work within Direct Payments.

For website and digital users

• IP address

• Cookie and usage data

• Information submitted through online forms

4. How we collect your information

We may receive information:

• Directly from you

• From the local authority

• From your employer (if you are a PA)

• From professionals involved in your care

• Through our online matching service

• Through our website or digital tools 

5. Why we use your information

For people receiving support, we use your information to:

• Provide information, advice and guidance

• Support you to manage Direct Payments

• Assist with employing PAs

• Keep accurate records of the support we provide

• Meet our contractual obligations with the local authority

For Personal Assistants (PAs), we use your information to:

• Support safe recruitment and employment

• Carry out right to work checks

• Support DBS applications

• Match you with suitable employers (with your consent)

• Provide advice, training or guidance

• Process payroll information (where relevant)

• Maintain accurate records of your role and support needs

Our lawful basis, we only use your information when we have a lawful basis under UK GDPR. This may include:

• Consent

• Performance of a contract

• Legal obligation

• Vital interests (to keep someone safe)

• Public task (where we deliver services on behalf of a local authority)

• Legitimate interests (for running and improving our service)

Under the Data (Use and Access Act) 2025, we may also rely on Recognised Legitimate Interests such as:

• Preventing fraud

• Ensuring network and information security

• Improving our services

• Supporting safe and effective digital service delivery

Research and service improvement

We may use information to evaluate or improve our services. Under DUAA, we may rely on broad consent or use data for research where providing individual notices which would involve disproportionate effort. We will always:

• Publish clear information about any research or evaluation activity

• Use the minimum amount of data necessary

• Protect your confidentiality and rights

6. Who we share your information with

For people receiving support, we may share information with:

• The local authority

• Payroll or managed account providers

• DBS services

• Insurance providers

• Your PA or care provider (with your agreement)

• IT and system providers

• Safeguarding teams where required

For Personal Assistants (PAs), we may share information with:

• Your employer (the Direct Payment recipient)

• The local authority (where required)

• DBS services

• Payroll providers

• Insurance providers

• Training or support partners

• IT and system providers

We never sell your data.

If we believe someone is at risk of harm, we may share information without consent with safeguarding teams or emergency services. We will always share the minimum information necessary to keep people safe.

7. International transfers

Some of our trusted IT providers may store data outside the UK. When this happens, we ensure appropriate safeguards are in place, such as UK GDPR‑approved Standard Contractual Clauses or equivalent protections. 

We also follow the updated international transfer rules introduced under the DUAA, including any new adequacy regulations or approved safeguards.

8. Automated decision‑making

Empower does not make solely automated decisions that have legal or similarly significant effects. If we use automated tools to support decisions (for example when supporting with PA recruitment), these tools do not replace human judgement.

Under the DUAA, you have the right to:

• Understand how automated tools contribute to decisions

• Request human review

• Challenge a decision 

9. How we store and protect your information

Your information is stored securely using encrypted systems and strict access controls. We keep information only for as long as necessary based on legal requirements, local authority contracts, and good practice.

When information is no longer needed, we delete or destroy it safely. A summary of our retention periods is available in our Data Retention Schedule.

10. Your rights

You have the right to:

• Access your information

• Ask us to correct inaccurate information

• Ask us to delete information (in certain circumstances)

• Restrict or object to how your information is used

• Withdraw consent at any time

• Request your information in a portable format

How to make a request

You can contact us at: dataprotection@empowerchoice.org.uk

We may ask for proof of identity before releasing information. We will respond within one month, unless an extension is permitted under UK GDPR.

Under the Data (Use and Access) Act 2025, we may apply limited exemptions to a request where disclosure would:

• Reveal another person’s information

• Create a safeguarding risk

• Prejudice crime prevention

• Involve disproportionate effort 

If we apply an exemption, we will explain why unless doing so would cause harm. 

11. Cookies and website use

We use essential cookies to make our website work. Under DUAA, we may also use certain cookies for statistical analysis or service improvement without needing your consent. You can still control all cookies through your browser settings.

12. How to raise a concern

Under the DUAA, you have the right to raise concerns about how your information is used. If you have questions or concerns, please contact us first by emailing dataprotection@empowerchoice.org.uk - we will respond promptly and clearly.

If you are not satisfied, you can contact the Information Commissioner’s Office (ICO) at ico.org.uk. Our Registration Number is ZC125748.