Privacy Notice: Employees and Contractors

Full Privacy Policy 

Data controller: Home From Home Care Limited (Company Number: 05106283) (HFHC)

Data Protection Compliance Officer: Steve Cranston

1.   Introduction

HFHC is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you.
HFHC collects, stores and processes personal data relating to its employees and other individuals who undertake work for it as independent contractors or consultants, in order to manage the employment or other working relationship. This privacy notice sets out how HFHC collects and uses personal information about you prior to, during and after your working relationship with us.
The personal information may be held by HFHC on paper or in electronic format.

This privacy notice applies to current and former employees, trainees (including graduate trainees) workers, contractors and consultants, volunteers, internships and work experience placements, throughout this notice referred to collectively as “employees”. This notice does not form part of a contract of employment or any contract to provide services and may be updated at any time.

HFHC is committed to protecting the privacy and security of your personal information and to meeting its data protection obligations under the General Data Protection Regulation (“GDPR”) and Data (Use and Access) Act (DUAA) HFHC is committed to being clear and transparent about how it collects and uses that data and to meeting its data protection obligations. The purpose of this Privacy Notice is to make you aware of how and why we will collect and use your personal information both during and after your working relationship with HFHC.

2.   Data Protection Principles

HFHC complies with data protection law. This means that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way; 
• Collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with these purposes; 
• Relevant to the purposes we have told you about and limited to those purposes only; 
• Accurate and kept up to date;
• Kept only for such time as is necessary for the purposes we have told you about; and
• Kept securely.

3.   What Information Does HFHC Collect and Process?

HFHC collects and processes a range of personal information (personal data) about you. Personal data means any information which relates to you and from which you can be identified. This includes information set out in Schedule 1 to this Notice. We may also collect, store and use the special categories of more sensitive personal information which are set out in Schedule 2 to this Notice.

HFHC collects this information in a variety of ways. For example, data is collected through the application and recruitment process and during work-related activities throughout your period of working for us. In some cases, HFHC collects personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.

We will collect additional personal information throughout your period of employment with us which may be collected during the course of your work-related activities. Whilst some of the personal information you provide to us is statutory and/or mandatory or a contractual requirement, some of it you may be asked to provide to us on a voluntary basis. We will inform you whether you are required to provide certain personal information to us or if you have a choice in this.

Data (including Personal Data) is collected and stored in a range of different ways and places through/on our digitally enabled IT platform Zone Standard. This enables us and any other companies in the group of companies of which HFHC forms part or any associated company (Group) that you have dealings with either now or in the future to manage both our obligations to you and your employment relationship with us/ the Group.

4.   Why Does HFHC Process Personal Data?

HFHC needs to process personal data to enter into an employment contract with you and for both parties to meet their obligations under the employment contract. In addition, HFHC needs to process personal data to ensure that we are complying with our legal obligations, for example, we are required to check an employee’s entitlement to work in the UK. For certain positions, it is necessary to carry out criminal records checks to ensure that individuals are permitted to undertake a particular role given the nature of our organisation due to the nature of its work with vulnerable adults. Additionally, HFHC has a legitimate interest in processing personal data before, during and after the end of the employment relationship. We collect data through our digitally enabled IT platform Zone Standard as an integral part of HFHC’s everyday operations and processes. We use this data to continually improve our processes and develop the way we operate our model of care. This may impact on you, our staff, the individuals we support and their families, our commissioners and regulators. Against this background, we will process your personal information relying on one or more of the following grounds:

• Where we need to do so to perform the employment contract, casual worker agreement, consultancy agreement or contract for services we have entered into with you;
• Where we need to comply with a legal obligation such as where laws or regulations may require us to use your personal information in certain ways;
• Where we need to comply with our contractual obligations including to those to whom we are contracted to provide a service, for example those who commission with us;
• Where it is necessary in any of:
  • a. our legitimate interests;
  • b. the legitimate interests of those we are commissioned to support, their families, our commissioners and regulators; c. the legitimate interests of any other third party
• and your interests or your fundamental rights and freedoms do not override these interests.
• When relying on this ground we will carry out a balancing test of our interests in using your personal information against the interests you have as an employee and the rights you have under data protection laws;
• Where it is necessary to establish, exercise or defend a legal claim including if you, we or an Individual we Support brings a legal claim or a claim is brought against you, us or an Individual we Support we may use personal data in either establishing our position or defending ourselves in relation to that legal claim or in order to establish our position or defend ourselves;
• In certain circumstances we may need your consent unless authorised by law in order to use personal information about you which is classed as special category data.
• We may occasionally use your personal information where we need to protect your vital interests or someone else’s, such as the Individuals we Support.

5.   Situations in Which We Will Use Your Personal Information

Situations in which we anticipate we may process your personal information are set out in Schedule 3 to this Notice:
Please note that we may process your personal information without your consent provided we process that information lawfully.

6.   If You Fail to Provide Personal Information

If you do not prove certain information when requested, HFHC may not be able to perform the contract we have entered into with you, such as paying you or providing a benefit. You may also have to provide HFHC with data in order to exercise statutory rights, for example in relation to statutory leave entitlements, without the provision of that information, you may also be unable to exercise your statutory or contractual rights.

7.   Change of Purpose

HFHC will only use your personal information for the purpose for which it was collected unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will advise you of this and explain the legal basis which allows us to do so. You should be aware that we may process your personal information without your knowledge or consent where this is required or permitted by law. We may also issue a new Privacy Notice to you.

8.   How We Use Sensitive Personal Information

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (for example, in relation to employees with disabilities and for health and safety purposes).
HFHC uses other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or philosophical belief, this is only done for the purposes of processing set out in Schedule 4 to this Notice. Where data is used by HFHC for the purposes of equal opportunities reporting, recording and monitoring, data is anonymised or is collected with your express consent it can be withdrawn at any time. You are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so HFHC is required to obtain details about past criminal convictions as a condition of employment. HFHC also undertakes DBS checks on all staff due to the nature of its work supporting vulnerable adults. 

There are occasions when HFHC will need to share special data with work colleagues within HFHC for example Occupational Health Services may seek information from other teams or share information with the HR Team about fitness to work. HFHC will only process this data with your explicit consent; this means you will be asked specifically for your permission for disclosure of such special data. Circumstances may also arise where special data is shared within HFHC without first obtaining your explicit consent. The circumstances when we can do this are set out in Schedule 5 of this document.

Information About Criminal Convictions

We envisage that we will hold information about criminal convictions to the extent necessary to confirm whether a DBS criminal record check has returned a satisfactory or unsatisfactory result. There may though be exceptional circumstances where the information in the criminal record check has been assessed by HFHC or HFHC’s regulatory body, the Care Quality Commission (CQC) as relevant to the ongoing working relationship. If it has been assessed as relevant to the ongoing working relationship, a DBS criminal record check will be deleted following the next CQC Audit or once the conviction is “spent” if earlier (information about spent convictions may be retained where your role is an excluded occupation or profession). We will only collect information about criminal convictions if it is appropriate given the nature of your role and where we are legally able to do so. We will use information about criminal
convictions in the following ways:

• In compliance with CQC requirements to check the suitability of all staff ensuring recruitment practices are effective and safe;
• In compliance with CQC requirements to ensure renewal of the DBS check to maintain assurances as to the suitability of staff.

9.   Automated Decision-Making

Our employment decisions are not based on automated decision-making.

10.   For How Long Do You Keep Data?

HFHC will only hold your personal data for as long as is necessary to fulfil the purposes we collected it for, including any legal, accounting, regulatory or reporting requirements. The periods for which your data is held after the end of employment is generally 6 years although further guidance on retention periods is set out in our Retention Notice.

11.   Who Has Access to Data?

HFHC is part of a Group and we will share information (including personal data) between the members of the Group on a need to know basis; this may include sharing your personal data with functions such as legal, accounting and internal audit. Your information will be shared internally as set out in Schedule 6.
HFHC shares your personal data with third parties where required by law, where it is necessary in order to administer the working relationship with you, in order to deliver our services in accordance with our model of care or where we have another legitimate interest in doing so Services carried out for us by third party service providers are set out in Schedule 7.

Our business is the provision of high acuity residential care and support services to individuals with autism, learning disabilities and complex health issues. Increasingly we are using film and images in the everyday operation of our business, both as an information gathering (including in relation to Specialist Teams processes, i.e. HR/Insight) and efficient and effective communication tool. We may and are sometimes required to share your data with our commissioners and regulators as well as with the families of the individuals we support and our advisers/consultants/insurers. Usually it is data that you have already given to us which we will share with commissioners and regulators. We usually only share data with commissioners and regulators as part of a contract monitoring or compliance visit or inspection. If we are asked to provide information that we do not hold, we will ask you for that information and to consent to it being shared at the time we are asked to provide it.

HFHC may also share your data with other third parties where we consider we have a legitimate interest in so doing. One example would be in the context of a sale of some or all of its business. In those circumstances the data will be subject to confidentiality arrangements.
HFHC may disclose data to auditors undertaking investigations or to selected individuals acting on behalf of HFHC such as organisations undertaking market or academic research provided no personal data is published HFHC will often confirm dates and the nature of an individual’s employment to a prospective employer in a reference. In certain circumstances HFHC may pass data on staff debtors to an external debt collection agency if HFHC has been unable to recover any debts by normal internal financial or HR processes.

12.   How Does HFHC Protect Data?

HFHC takes the security of your personal data seriously. HFHC has internal policies, procedures and controls in place to prevent your data being lost, accidentally destroyed, misused or disclosed. All data is subject to a series of permissions so as to ensure it is not accessed except as authorised by other employees, workers, contractors or consultants where they have a need to know in the proper performance of their duties. Similarly, with agents and other third parties who have a business need to know in order to properly perform their duties and responsibilities. When HFHC engages third parties to process personal data on its behalf, they do so on the basis of written instructions, where third parties are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of such data.

We only allow them to process your personal information for specified purposes and in accordance with our own written instructions and we do not allow them to use your personal information for their own purposes. HFHC also has in place procedures to deal with a suspected data security breach and we will notify the Information Commissioner’s Office (or any other applicable supervisory authority or regulator) and you of a suspected breach affecting your data where we are required to do so.

13.   Your Duty to Inform Us of Changes

It is important that the personal information we hold about you is accurate, relevant and current. Please be sure to keep us informed if your personal information changes during your time working with us.

14.   Your Rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your personal data on request (known as a “data subject access request”);
• require HFHC to change incorrect or incomplete personal data;
• request erasure of your personal information. This enables you to ask HFHC to delete or stop processing your personal data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your personal data where HFHC is relying on its legitimate interests as the legal ground for processing; and
• ask HFHC to suspend the processing of your personal data for a period of time if data is inaccurate or there is a dispute about its accuracy or the reason for processing it.

If you would like to exercise any of these rights, or you have any questions about the privacy notice, please contact the Data Protection Compliance Officer.

If you believe that HFHC has not complied with your data protection rights, you have the right to make a complaint to the Information Commissioner’s Office.

Schedule 1 

Schedule 2 

What Special Information Will We Process?

• information about medical or health conditions, including whether or not you have a disability for which HFHC needs to make reasonable adjustments;
• sickness absence records (including details of the reasons for sickness absence being taken)
• medical reports and related correspondence • details of trade union membership;
• information about your criminal record; and
• equal opportunities monitoring information, including information about your ethnic origin,sexual orientation, health and religion or belief.

Schedule 3 

Situations in which we will process your personal information  

• make decisions about recruitment, secondment and promotion processes;
• match an employee with an Individual we Support as part of a core team;
• maintain accurate and up-to-date employment records and contact details (including details of whom to contact in the event of an emergency), and records of employee contractual and statutory rights;
• check you are legally entitled to work in the UK;
• gather evidence for, and keep a record of, disciplinary, capability and grievance processes, to ensure acceptable performance and conduct within the workplace;
• pay you and make deductions for tax and National Insurance including liaising with any external benefits, pension providers, insurers, student loan providers and childcare voucher providers;
• administer the Contract we have entered into with you;
• ensure compliance with your statutory and contractual rights;
• ensure compliance with the contractual and other reasonable requirements of those for whom we are contracted to provide a service, our commissioners;
• ensure compliance with our regulator; the Care and Quality Commission;
• maintain effective systems and control in respect of employee identification and security;
• make decisions about salary reviews and compensation;
• make decisions about secondment arrangements and experience weeks;
• operate and keep a record of employee performance and related processes;
• manage, plan and organise work including your rota (if applicable);
• enable effective workforce management;
• keep records of training, development and competency requirements;
• operate and keep a record of absence and absence management procedures, to allow effective workforce management
• protect the vital interests of the Individuals we Support;
• prevent fraud;
• using various media (including YouTube and other social media platforms) to
  1. communicate internally and externally i.e. Twitter, Parent Portal, Zone Standard;
  2. demonstrate transparency in the delivery of care;
  3. evidence the processes employed in and the nature of the specialist service we provide to the individuals we support (often using images, film, voice recording (including live streaming and case studies);
  4. in connection therewith to celebrate achievement;
  5. raise awareness;
  6. inform and educate.

Schedule 4 

Situations in which we will process your sensitive personal information

In order to:

• assess your suitability for employment, engagement or promotion;
• match an employee with an Individual we Support as part of a core team comply with statutory and/or regulatory requirements and obligations such as carrying out DBS checks;
• ensure compliance with and communication about the contractual and other reasonable requirements of those for whom we are contracted to provide a service and owed to our commissioners;
• ensure compliance with our regulator; the Care and Quality Commission;
• comply with the duty to make reasonable adjustments for disabled employees and workers and with other disability discrimination objectives;
• administer the contract we have entered into with you;
• maintain effective systems and control in respect of employee identification and security;
• ensure compliance with your statutory and contractual rights;
• operate and maintain a record of sickness absence procedures;
• ascertain your fitness to work;
• ascertain your fitness to be an authorised driver if applicable;
• manage, plan and organise work including your rota;
• enable effective workforce management;
• make decisions about secondment arrangements;
• ensure payment of SSP;
• meet our obligations under health and safety laws;
• make decisions about continued employment or engagement;
• operate and maintain a record of dismissal procedures;
• ensure effective HR, personnel management and business administration;
• ensure adherence to Company rules, policies and procedures;
• monitor, report and record on equal opportunities including Gender Pay Gap Reporting;
• provision of wellbeing and support services;
• provision of Occupational Health and Wellbeing services to individuals ;
• protect the vital interests of the Individuals we Support; and,
• prevent fraud.

Schedule 5

Circumstances in which we may share special data without your explicit consent

This will only occur if the processing is necessary:

• To protect your vital interests and you cannot give your consent for your consent cannot be reasonably obtained
• To protect another person’s vital interest and you have unreasonably withheld your consent
• For the discharge of any function which is designed for the provision of confidential counselling, advice, support or other service
• Your consent cannot be given
• We cannot reasonably obtain your explicit consent
• Requiring your explicit consent would prejudice the provision of that counselling, advice, support or other service
• To meet our statutory obligations in relation to equality and diversity monitoring
• The disclosure is made for the purposes of prevention or detection or crime, the apprehension or prosecution of offenders and we have received a notice from the policy confirming that disclosure is required for these purposes
• Pursuant to a Court Order requiring disclosure

Schedule 6

Who has access to data internally?

• Our Intersourcers
• Your Line Manager
• Other Managers in the Team and/or location in which you work;
• Directors

Schedule 7

Services provided by third party providers

• External organisations for the purposes of carrying out pre-employment reference and background checks i.e. DBS;
• Payroll providers;
• Pension scheme provider and pension administration;
• Benefits providers and benefits administration including insurers and childcare vouchers;
• Occupational health providers;
• Medical professionals;
• External IT services;
• External auditors;
• Insurers;
• Consultants;
• Professional advisers such as lawyers and accountants.
• Care Quality Commission (CQC).

Last Reviewed:

18 Feb 2026 (Version 2)

Next Review:

Feb 2027