Privacy Policy

Introduction

Empower Family Group respects your privacy and is committed to protecting your personal data. This privacy notice explains how we collect, use and look after your personal data, tells you about your privacy rights, and explains how the law protects you.

This notice applies to the personal data of:

the young people and adults we support;

our employees, workers and volunteers;

applicants for roles with us;

visitors to our websites; and

other individuals we deal with, such as family members, professionals and contacts at organisations we work with.

We provide this notice in a layered format. Please also use the Glossary at the end to understand some of the terms used.

You should read this notice alongside any other privacy or fair processing notice we give you on specific occasions. This notice supplements those and is not intended to override them.

Who we are (Controller)

Empower Family Group is made up of different legal entities. Details of the entities can be found here: https://www.empowerfamilygroup.co.uk/terms-of-use

This notice is issued on behalf of the group, so when we say “Empower”, “we”, “us” or “our”, we mean the relevant company in the Empower Family Group responsible for processing your data.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions about this notice and our handling of personal data. Please contact the DPO if you have any questions or wish to exercise your rights.

Legal entity: Empower Family Group

DPO: Fraser McIlwraith

Email: dpo@empowerfamily.co.uk

Postal address: Unit 2 Prockters Farm Offices, West Monkton, Taunton, Somerset, TA2 8QN

The personal data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer the following kinds of personal data:

Identity Data: first name, last name, maiden name, username or similar identifier, marital status, title, date of birth and gender.

Contact Data: address, email address and telephone numbers.

Care and Support Data: information about your background, needs, care and support, placements, incidents and progress (for the young people and adults we support).

Employment Data: records relating to your recruitment, employment or engagement with us (for staff, workers, volunteers and applicants), including references, qualifications, right to work and DBS information.

Technical Data: internet protocol (IP) address, login data, browser type and version, time zone and location, operating system and platform, and other technology on the devices you use to access our websites.

Usage Data: information about how you use our websites.

Marketing and Communications Data: your preferences for receiving marketing from us and your communication preferences.

We also use Aggregated Data (such as statistical or demographic data) for various purposes. Aggregated Data may be derived from your personal data but is not personal data in law, because it does not identify you. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data.

Special category and criminal offence data

We collect special category data. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, and genetic and biometric data.

For the young people and adults we support, we may obtain this from application and referral forms (completed by you or on your behalf), from notes and reports about your background, health, treatment and care, and from records of our contact with you, including complaints, incidents and referrals from commissioning bodies.

For staff and job applicants, we may obtain this from application forms, CVs and the recruitment and screening process.

We also process information about criminal convictions and offences, primarily as part of our recruitment, screening and safeguarding responsibilities.

We only process special category and criminal offence data where we have a lawful basis under Article 9 or Article 10 of the UK GDPR and, where required, a condition under Schedule 1 of the Data Protection Act 2018. The conditions we rely on include:

Health or social care (Article 9(2)(h); DPA 2018 Schedule 1, Part 1, paragraph 2), for delivering and managing care and support;

Safeguarding of children and individuals at risk (DPA 2018 Schedule 1, Part 2, paragraph 18);

Employment, social security and social protection (Article 9(2)(b); DPA 2018 Schedule 1, Part 1, paragraph 1), for our obligations as an employer;

Equality of opportunity or treatment (DPA 2018 Schedule 1, Part 2, paragraph 8), for diversity monitoring.

Where we rely on a Schedule 1 condition that requires it, we maintain an Appropriate Policy Document explaining our compliance and retention measures, which is available on request from the DPO.

How your personal data is collected

We collect data:

Directly from you or someone acting on your behalf, for example when you fill in forms, apply for a role, correspond with us, or are referred to us for support.

From third parties, such as local authorities and commissioning bodies, previous employers (references), the Disclosure and Barring Service, health and social care professionals, and other organisations involved in your care or employment.

Automatically, as you interact with our websites. We collect Technical and Usage Data using server logs and similar technologies, and cookies (see the Cookies section).

How and why we use your personal data

We only use your personal data when the law allows us to. Most commonly we rely on one or more of the following lawful bases:

performance of a contract;

compliance with a legal or regulatory obligation;

our legitimate interests (or those of a third party); and

consent (for example, for certain marketing or certain cookies).

We may rely on more than one lawful basis depending on the purpose. Contact the DPO if you need details of the specific basis for a particular activity.

To deliver care and support to the young people and adults we support
Type of data: Identity; Contact; Care and Support; Special category
Lawful basis: Performance of a contract with the relevant local authority; legal obligation; and, for special category data, the health or social care and safeguarding conditions set out above

To recruit, employ and manage our staff, workers and volunteers
Type of data: Identity; Contact; Employment; Special category; Criminal offence
Lawful basis: Performance of a contract; legal obligation; legitimate interests; and, for special category and criminal offence data, the employment and safeguarding conditions set out above

To manage our relationship with you (for example, notifying you of changes to our terms or this notice, or asking you to complete a survey)
Type of data: Identity; Contact; Marketing and Communications
Lawful basis: Performance of a contract; legal obligation; legitimate interests

To administer and protect our business and websites (troubleshooting, data analysis, testing, maintenance, support, reporting, hosting and security)
Type of data: Identity; Contact; Technical
Lawful basis: Legitimate interests (running our business and IT services, network security, fraud prevention, and in the context of a business reorganisation); legal obligation

To use analytics to improve our websites and services
Type of data: Technical; Usage
Lawful basis: Consent (where required for non-essential cookies); legitimate interests

We will only use your personal data for the purposes we collected it for, unless we reasonably consider we need to use it for a compatible purpose. If we need to use it for an unrelated purpose, we will notify you and explain the legal basis, unless the law allows us to process without your knowledge or consent.

Marketing

We do not share your personal data with any company outside the Empower Family Group for their own marketing purposes.

You can ask us to stop sending you marketing messages at any time by using the opt-out link in any marketing message or by contacting us.

Cookies

We use cookies and similar technologies on our websites.

Strictly necessary and low-risk cookies (for example, cookies that remember your preferences or keep the site secure) are used across our websites without consent, in line with the Privacy and Electronic Communications Regulations 2003 as amended by the Data (Use and Access) Act 2025.

Analytics and advertising cookies (Google Analytics and Google Ads) are only used on our fostering website, empowerfostering.co.uk, and only where you have given consent through the cookie banner on that site. You can withdraw consent at any time. We do not use analytics or advertising cookies on our other websites.

Who we share your personal data with

We may share your personal data with:

Other companies in the Empower Family Group, which provide IT, administration, and leadership and management support.

Local authorities and commissioning bodies responsible for the young people and adults we support.

Regulators and inspectorates, such as Ofsted.

Health, social care and safeguarding partners, including the NHS, safeguarding partnerships and, where necessary, the police.

The Disclosure and Barring Service, for recruitment and safeguarding checks.

Service providers who provide IT and system administration services.

Professional advisers, including lawyers, bankers, auditors and insurers.

HM Revenue & Customs, regulators and other UK authorities where reporting is required.

Third parties in connection with a business sale, transfer or reorganisation. If our business changes hands, the new owners may use your personal data as set out in this notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes, and we only permit them to process it on our instructions.

International transfers

Some of our service providers, including Microsoft, may process personal data outside the UK. Where we transfer personal data outside the UK, we make sure it is protected by an appropriate safeguard, which may include:

transfers to a country the UK has deemed to provide an adequate level of protection;

the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it; or

the International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

You can ask the DPO for more information about the safeguards we use.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, or used, accessed, altered or disclosed in an unauthorised way. We limit access to your personal data to those who have a business need to know, and they are subject to a duty of confidentiality. We also have procedures to deal with any suspected personal data breach and will notify you and the regulator where we are legally required to do so.

Data retention

We only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including to meet any legal, accounting or reporting requirements. To decide the appropriate retention period, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, whether we can achieve those purposes another way, and applicable legal requirements. Details of our retention periods are available on request from the DPO.

Your rights

Under data protection law you have the right to:

request access to your personal data;

request correction of inaccurate or incomplete data;

request erasure of your personal data, where there is no good reason for us to continue processing it;

object to processing based on our legitimate interests, and to object to direct marketing at any time;

request restriction of processing in certain circumstances;

request transfer of your personal data to you or a third party, where processing is based on consent or contract and is automated; and

withdraw consent at any time, where we rely on consent.

To exercise any of these rights, please contact the DPO.

No fee, usually. You will not normally have to pay a fee. We may charge a reasonable fee, or refuse to comply, if your request is manifestly unfounded or excessive, or if you ask for further copies.

What we may need from you. We may need to confirm your identity before responding, as a security measure, and may contact you for further information to speed up our response.

Time limit. We try to respond to all legitimate requests within one month. If your request is complex or you have made a number of requests, it may take longer, in which case we will notify you and keep you updated. If we need to ask you for clarification, the time limit is paused until we receive it.

How to complain

If you have a concern about how we handle your personal data, please contact the DPO in the first instance. We will acknowledge your complaint and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at any time (www.ico.org.uk). We would appreciate the chance to address your concerns before you approach the ICO.

Automated decision-making

We do not make decisions about you using solely automated means that produce legal or similarly significant effects. If this changes, we will update this notice and explain the safeguards that apply.

Children’s data

Where we process the personal data of children and young people, we take account of their needs and the additional protection they merit, in line with the law and the ICO’s Children’s Code. A child-friendly version of this notice is also available on our website.

Third-party links

Our websites may include links to third-party websites, plug-ins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy statements. We encourage you to read the privacy notice of every website you visit.

Changes to this notice

We keep this notice under regular review. This version was last updated on 11th August 2026. We will notify you of significant changes where appropriate.

Glossary

Consent means a clear affirmative action showing you agree to the processing of your personal data for a specific purpose.

Legitimate Interest means the interest of our business in conducting and managing it so we can give you the best and most secure service. We balance any impact on you and your rights before relying on this basis, and we do not rely on it where our interests are overridden by the impact on you.

Performance of Contract means processing your data where it is necessary to perform a contract you are party to, or to take steps at your request before entering into a contract.

Legal or regulatory obligation means processing your personal data where it is necessary to comply with a legal or regulatory obligation we are subject to.

Special category data means the categories of more sensitive personal data listed above, which require additional protection.