Privacy Notice - Care to Connect
Voluntary Action Lochaber
🔐 A quick word about your information
Care to Connect is here to support you.
We understand that sharing information about your situation can feel personal. We are committed to being open about how we use your information, why we need it, and how we keep it safe, in line with our transparency obligations under Article 13 of the UK General Data Protection Regulation.
🏢 Who we are
Care to Connect is a service delivered by Voluntary Action Lochaber.
We support individuals and unpaid carers by offering a listening ear, helping you explore your options, and connecting you to the right support.
Voluntary Action Lochaber is the Data Controller for your personal information.
We do not currently have a designated Data Protection Officer. Responsibility for data protection sits with the organisation.
📞 Contact details
If you have any questions about how we use your information, you can contact us:
Data Protection Officer
Ms Marie McMillan
Voluntary Action Lochaber
An Drochaid
Claggan
FORT WILLIAM
Inverness-Shire
PH33 6PH
Email: marie.mcmillan@valochaber.org
Phone: 01397 706044
ICO Reference: Z6392641
📋 What information we collect
When you speak to us or use our service, we may collect:
• Your name and contact details.
• Information about your situation.
• Details about your caring role.
• Information about the support you need.
This may include more sensitive information, such as:
• Health or wellbeing.
• How your caring role is affecting you.
• Information relating to vulnerability or risk.
We only collect information that is necessary to support you.
🧩 How we collect your information
We collect information in different ways, including:
• Directly from you (for example, conversations, meetings, or when you contact us).
• When you complete referral or registration forms (including online forms such as Microsoft Forms).
• From carers, family members, or professionals.
• From partner organisations involved in your support.
This helps us understand your situation and provide the right support.
👥 Information about other people
If you care for someone, you may share some information about them with us.
In some cases, we may receive information about another person (for example, someone you care for).
We will only use this information where it is necessary to support you.
Where appropriate and practicable, we will consider whether to inform that individual that we hold information about them, in line with data protection law.
We only collect the minimum information required.
👶 Children and young people
Sometimes caring situations involve children or young people.
We only use this information where necessary and take extra care, particularly where safeguarding is involved and in line with our legal responsibilities.
⚙️ How we use your information
We use your information to:
• Understand your situation.
• Provide advice and support.
• Help you access services.
• Connect you with appropriate organisations.
• Support your health and wellbeing.
• Identify and respond to risks or safeguarding concerns.
• Keep appropriate records of our work with you.
⚖️ Our lawful basis for using your information
Data protection law requires us to have a legal reason for using your information. This is known as a “lawful basis”.
We carefully consider the impact on you and your rights before using this basis and do not believe our use of your information overrides your rights and freedoms.
• Legitimate interests – to assess your needs, provide advice and support, coordinate services, and make referrals as part of the Care to Connect service.
• Legal obligation – where we are required to comply with legal or regulatory duties, including safeguarding responsibilities and information sharing where required by law.
• Vital interests – in rare situations where it is necessary to protect you or another person from serious harm or risk to life.
Where we process health or wellbeing information (special category data), this is carried out under:
• Article 9(2)(h) UK GDPR – health and social care provision, where processing is necessary to provide support and coordinate services.
• Article 9(2)(g) UK GDPR – safeguarding of individuals at risk, where necessary to protect individuals from harm, together with the relevant safeguarding condition under Schedule 1 of the Data Protection Act 2018.
We process your information in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.
You have the right to object to processing based on legitimate interests.
🔄 How we share your information
Sometimes we may need to share information to help you get the right support.
This may include:
• NHS services.
• Local authority services.
• Highland Hospice.
• Other voluntary and community organisations.
We only share information where it is necessary to support you, and we only share what is relevant.
Where appropriate, we will seek your agreement before sharing your information. However, we may share information without your agreement where required by law or where there are safeguarding concerns.
This sharing is carried out in line with data protection law, using appropriate legal bases such as legitimate interests, legal obligations, safeguarding duties, or health and social care provision.
These organisations act as independent data controllers and are responsible for how they use your information.
🖥️ Use of service providers
We may use trusted service providers (such as IT systems, secure databases, and online forms platforms) to help us deliver our service.
These providers process information on our behalf under contractual agreements and are required to keep your data secure and confidential.
🛡️ Safeguarding
In some situations, we may need to share information without your agreement if we are concerned about your safety or someone else’s, or where required by law.
We will always do this carefully, proportionately, and record our decision.
🧰 How we use tools to support you
We may use simple tools (such as structured questionnaires or outcome tools) to help understand your needs and track progress.
These tools support conversations with you and do not replace professional judgement.
🗄️ How we store your information
We store your information securely and restrict access to authorised staff only.
We use appropriate technical and organisational measures to protect your information, including secure systems, access controls, and confidentiality requirements for staff.
🌍 International transfers
We do not transfer your data outside the UK unless appropriate safeguards are in place, such as adequacy regulations or approved contractual arrangements.
⏳ How long we keep your information
We keep your information only as long as necessary to support you and meet our responsibilities.
Typically, this is up to 5 years after your involvement with the service ends.
🧾 Your rights
You have the right to:
• Access your information.
• Ask us to correct anything that is inaccurate.
• Request deletion of your information (where appropriate).
• Restrict how your information is used.
• Object to how your information is used.
• Receive your information in a portable format, where applicable (in line with Article 20 of the UK General Data Protection Regulation).
Where we rely on your consent (for example, for communications or media), you can withdraw this at any time.
To exercise your rights, please contact us.
🤖 Automated decision-making
We do not make decisions about you using automated systems.
📢 Complaints
If you are unhappy with how we use your information, you can contact us in the first instance, and we will do our best to resolve your concerns.
You have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO):
Website: www.ico.org.uk
The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Phone: 0303 123 1113
🔄 Changes to this notice
We may update this Privacy Notice from time to time to keep it accurate and up to date.
📊 Version control
Version | Date | Author | Comments | Review date
V1.01 | 11/04/2026 | RB | Initial Version | 09/04/2027