Privacy Policy
Who We Are
Orbis Education and Care Limited, Pembrokeshire Resource Centre Limited, Gower Lodge (Swansea) Limited and Priority Childcare Limited, all registered at Vision Court, Caxton Place, Cardiff CF23 8HA (together, the "Orbis Group") provide specialist day schools and residential services for children, and community homes for adults who have complex needs associated with autism. We specialise in working with young people accommodated by the local authority whose complex needs and challenging behaviour require a supporting residential environment in order to achieve positive outcomes.
In order to provide our services, the Orbis Group (“Orbis”, “we”, “us” or “our”) gather and process personal data about a variety of individuals. This privacy notice tells you about your rights in relation to data we collect about you and explains how, why and when we use your personal data.
Unless this policy specifically states otherwise, we are the data controller for this information. Our contact details are: Orbis Education & Care, Vision Court, Caxton Place Pentwyn, Cardiff, CF23 8HA
In this notice
1 .Glossary
2. Why we are collecting your data
3. Information that we collect
4. How we use your personal data
5. How do we collect your data
6. Lawful basis for processing your personal data
7. Data Sharing
8. Transfers of your data overseas
9. Data Security
10. Retention Period
11. Your rights in relation to this processing
12. Consequences of Not Providing Your Data
13. Complaints around the processing
14. Changes to our Notice
1. Glossary
Where we refer in this notice to your ‘personal data’, we mean any recorded information that is about you and from which you can be identified, whether directly or indirectly. It does not include data where your identity has been removed (anonymous data).
Where we refer to the ‘processing’ of your personal data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.
2. Why We Are Collecting Your Data
We take your privacy very seriously. We will only use your information for the purposes specified in this privacy notice; unless we are required by law to do so. We will not collect any unnecessary personal data from you and will only keep your information for as long as is necessary and for these purposes.
The purposes for using your personal data are to enable us to provide our services, support the provision of high-quality care and education, and to meet our legal, statutory and contractual obligations.
3. Information That We Collect
In order to carry out our functions, the personal data that we process about you depends on the type of individual you are and how you interact with us.
For residents, pupils and young people we support, we will generally need to process quite detailed information about you, including (but not limited to) the following:
- Basic information such as your name, date of birth and contact details (including address, email, telephone number and next of kins details).
- Information about your education, including your safeguarding and special educational needs
- Any health conditions you may have, including any medication, allergies, details of diagnosis, treatment and care (including notes and reports about your health and well-being)
- Sensitive and characteristics details, including ethnicity, sexuality, religion or beliefs, and disability, behavioural, language information
- Information from people who care for you and know you well (such as health professionals, family members)
- Photographs that you have consented to be taken
- CCTV footage
We understand the importance of taking extra precautions to protect the privacy and safety of the children and young people under our care. We want you and those who support you to enjoy the best possible care and education from us, and we process the personal data that we require to help us achieve this. We only process the minimum amount of personal data that we need to perform the task that we are carrying out.
If you work for us or apply for a job, we will collect information about you. We have separate privacy notices for job applications and for our staff.
If you are a visitor to our website, we collect two kinds of electronic information direct from visitors to our website; feedback and email subscription details. Where personal data is provided, we process this information for reasons, to include:
- Providing you with information you have requested
- Handling your enquiries
- Providing access to certain areas of our websites
- Informing you of services which may be relevant to you
- Auditing use of our systems and websites
- Handling of complaints and concerns
4. How We Use Your Personal Data?
In the main, we process your personal data for purposes directly connected with ensuring that you receive high quality care and education at Orbis. It is important for us to be provided with the personal data that we may request, as this information assists us to deliver and provide improved care and appropriate treatment plans to fully meet your needs, and:
- Helps inform our decisions we make about your care
- Ensures that your treatment is safe and effective
- Helps us work effectively with other organisations who may be involved in your care
- Helps us to ensure our services can meet future needs
- Allows us to review the care provided to ensure it is of the highest standard possible
5. How Do We Collect Your Data?
We collect your personal data from a variety of sources, including:
- Information provided directly to us by yourself and/or a relative
- Information provided by other organisations you may be using (e.g. Local Authorities)
- Referral from your commissioning team
6. Lawful Basis for Processing Your Personal Data
UK data protection legislation requires us to ensure that we always have a valid legal basis for processing personal data. Depending on the processing activity, we rely on the following lawful basis for processing your personal data:
- If you have a contract with us, where the processing is necessary for the performance of that contract
- Where the processing is necessary for us to comply with our legal obligations. For instance, we are required by our regulators to retain certain records of those we support (i.e. residents, pupils and young people]
- Where the processing is necessary for our own legitimate interests. For instance, where we need to collect and use personal data in order to run our business efficiently
- With your consent. For instance, if you have agreed to receive marketing material from us
Where you have consented to receive marketing material from us, you are free to withdraw this consent at any time.
There are additional rules for processing 'special categories' of personal data, which includes information about health and medical conditions. We will only process this type of information where it is necessary to provide you with care or in order to comply with our legal and regulatory obligations.
7. Data Sharing
In some circumstances, such as under a court order, we are legally obliged to share information. We may also share information about you to perform our contractual and other legal responsibilities, and we may, from time to time, need to share your information between the companies within the Orbis Group in order for us to be able to carry out our functions.
Additionally, you may be receiving care and/or educational support from other organisations, as such if there is a genuine need for it or if we have your consent, we may share your personal data with them so we can all work together for your benefit. Those organisations we may share your information with include:
- Healthcare organisations [i.e. Hospitals, GPs and other bodies involved in your care]
- Social care services
- Education services
- Local authorities
- Safeguarding teams
- Estyn
- Care Inspectorate Wales
- Ofsted
- Services you may use after leaving us
Where information is shared, we will seek to share the minimum amount necessary. Anyone receiving personal data about you are under a legal duty to keep it confidential. We will never sell your personal data and we will not share it without the appropriate legal authority, or if appropriate to the circumstances, your informed consent.
8. Transfer of Your Data Overseas
We don’t routinely transfer your personal data outside the UK, but if we are required to transfer or store your information outside the UK, for example we are engaged with a third-party provider; and they, and/or a sub processor engaged by them, results in your information being transferred outside the UK, or we engage with a cloud-based service provider that operates outside the UK meaning personal data can be sent to other jurisdictions. We ensure we have the appropriate safeguards in place to protect your information.
To the extent that your personal data is transferred outside the UK, such transfers will only take place if one of the following applies:
- The country receiving the data is considered by the UK to provide an adequate level of data protection
- The organisation receiving the data is covered by a contractual arrangement recognised by the UK as providing an adequate standard of data protection
- The transfer is governed by approved contractual clauses
- The transfer has your consent
- The transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract
- The transfer is necessary for the performance of a contract with another person, which is in your interests
- The transfer is necessary in order to protect your vital interests or of those of other persons, where you or other persons are incapable of giving consent
- The transfer is necessary for the exercise of legal claims
- The transfer is necessary for important reasons of public interest
9. Data Security
We take the security of your data very seriously, whether it is electronic or in paper form. We have internal policies and controls in place, and use appropriate technical, organisational and administrative security measure to protect any information we hold from loss, misuse, unauthorised access or disclosure and is not accessed except by employees or organisations acting on our behalf in the performance of their duties. Some of your personal data, in paper form, may be held with our off-site storage contractor.
We use third parties to provide us with certain IT services and business functions. Where weengage with third parties to process personal data on our behalf, they do so based on written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data. Before engaging with a third party we make sure that they have appropriate measures in place to secure your personal data.
10. Retention Period
We will retain your data for as long as we need it to fulfil our purposes to meet our legal obligations, after which time they will be destroyed. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
All records are retained and destroyed in accordance with our retention policy, which sets out the appropriate period each type of record is retained.
Where you have consented to us using your details for marketing purposes, we will keep such data until you notify us otherwise and/or withdraw your consent. For more information about our data retention policies, please contact our Data Protection Officer.
11. Your Rights in Relation to this Processing
As an individual you have certain rights regarding our processing of your personal data, including a right to lodge a complaint with the Information Commissioners Office as the relevant supervisory authority. Under UK data protection legislation, you have a right to:
- Request access to your data (commonly known as a "subject access request")
- Request correction of your data
- Request erasure of your data
- Object to processing of your data
- Request the restriction of processing of your data
- Request the transfer of your data to another party
Some of these rights are limited and we cannot always comply with your request. We will tell you if that is the case.
For the purpose of effective compliance with UK data protection legislation, we consider that automated decision making (where a decision is taken about you using an electronic system without human involvement) is not engaged by us as a data controller of your personal data.
If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request. This is to ensure that your data is protected and kept secure.
12. Consequences of not Providing Your Data
You are not obliged to provide your personal data to us. However, we may not be able to provide all of our services without it. We will tell you if this is the case.
13. Complaints Around the Processing
If you want to exercise any of the rights described above or are dissatisfied with the way we use your personal data, please contact our Data Protection Officer at:
Orbis Education & Care Ltd
Vision Court, Caxton Place
Cardiff
CF23 8HA
02920 029922
If you remain dissatisfied with our response, you can contact the UK regulator the Information Commissioner at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Fax: 01625 524 510
Website: https://ico.org.uk/
14. Changes to Our Notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.
