Privacy Policy
Last Updated: 22nd June 2026
Introduction
At halow project, we are committed to protecting and respecting your privacy.
This privacy policy explains how we collect, use, store, share and protect personal information. It applies to the work of halow project and halow care, including our charity activities, website, fundraising, referrals, care and support services, adult social care provision, staff records, volunteers, donors, families, advocates and professionals we work with.
This policy is written in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other relevant legislation and guidance.
For the purpose of data protection law, the data controller is:
halow project and halow care
Carroll House
11 Quarry Street
Guildford
Surrey
GU1 3UY
halow is currently made up of several projects across the organisation. These services share the same data protection procedures to ensure consistent, lawful and secure processing of personal information.
This policy should be read alongside halow’s Information Asset Register, Record of Processing Activities, Data Retention Schedule and other relevant policies and procedures.
Our commitment to data protection
halow applies the principles of UK GDPR when collecting and using personal information.
This means that personal information will be:
- processed lawfully, fairly and transparently
- collected for clear and legitimate purposes
- adequate, relevant and limited to what is necessary
- accurate and kept up to date where needed
- kept for no longer than necessary
- processed securely and protected against unauthorised access, loss or misuse
We will only collect and use personal information where we have a lawful reason to do so.
Information we may collect from you
There are many ways that halow may lawfully collect personal information. This may include information collected through:
- referral forms
- care and support assessments
- care planning and reviews
- risk assessments
- daily care records and support notes
- safeguarding records
- incident and accident reports
- medication records, where applicable
- correspondence with individuals, families, advocates, local authorities, health professionals and other professionals
- donation forms
- fundraising activities
- event registrations
- job applications
- volunteering applications
- website forms
- mailing list subscriptions
- surveys
Information that you provide by filling in forms on our website, halowproject.org.uk, may include information provided when registering to use the website, subscribing to our mailing list, requesting material, making enquiries, making donations, reporting a problem with our website or requesting further services.
If you contact us, we may keep a record of that correspondence.
We may also ask you to complete surveys that we use for research, feedback or service improvement purposes. You do not have to respond to these unless you choose to do so.
We may collect details of transactions you carry out through our website and details of your visits to our website, including but not limited to traffic data, location data, weblogs and other communication data.
halow will not store financial card information when transactions are completed over the phone, online or in person.
Information we collect when providing care and support
As an adult social care provider, halow collects and uses personal information so that we can provide safe, effective and person-centred care and support.
This may include:
- name, address, date of birth and contact details
- emergency contact details
- details of family members, advocates, representatives or attorneys
- care and support plans
- risk assessments
- daily care records and support notes
- health information
- disability-related information
- medication information, where relevant
- communication needs
- mobility needs
- dietary needs
- personal care needs
- mental capacity information, where relevant
- information about decision-making support
- safeguarding information
- incident and accident records
- behaviour support information
- information about wishes, feelings, choices, routines, preferences and outcomes
- records of reviews, meetings and professional discussions
- information shared by local authorities, NHS services, GPs, families, advocates and other professionals involved in a person’s care
Some of this information is known as special category data under UK GDPR because it may relate to a person’s health, disability, care needs or other sensitive personal information.
We only collect the information that is necessary to provide care and support, meet our legal and regulatory responsibilities, keep people safe and manage the service properly.
Why we use personal information
We use personal information to:
- provide care and support
- assess care and support needs
- create, update and review care plans
- complete and review risk assessments
- record daily support and important information
- support people’s wishes, choices, preferences and outcomes
- manage medication support where this forms part of a person’s care
- respond to accidents, incidents, concerns or safeguarding matters
- work with local authorities, commissioners, social workers, health professionals and other agencies
- meet our legal and regulatory duties as an adult social care provider
- evidence the quality and safety of the care and support we provide
- respond to complaints, concerns, investigations, audits or inspections
- manage contracts and commissioned care arrangements
- communicate with individuals, families, advocates and representatives where appropriate
- provide information, products or services that you request from us
- tell you about our fundraising activities, where it is lawful and appropriate to do so
- manage donations and fundraising activities
- manage staff, volunteer and recruitment processes
- improve our services
- keep our website secure and functioning properly
- notify you about changes to our services
Lawful basis for using personal information
halow will not always rely on consent to use personal information.
In adult social care, information often needs to be used because it is necessary to provide care safely, meet legal duties, protect people from harm, work with commissioners and professionals, or comply with regulatory requirements.
The lawful bases under Article 6 of UK GDPR that halow may rely on include:
Contract
We may process personal information where it is necessary to provide care, support or another service under a contract, placement agreement, commissioned arrangement or other agreement.
Legal obligation
We may process personal information where we are required to do so by law. This may include keeping care records, reporting concerns, cooperating with regulators, responding to safeguarding matters, managing employment records or meeting adult social care requirements.
Vital interests
We may process or share personal information where this is necessary to protect someone’s life or prevent serious harm.
Legitimate interests
We may process personal information where this is necessary for the running of halow, service management, quality assurance, safeguarding follow up, complaints, investigations, fundraising administration, insurance, legal advice or organisational improvement, provided this does not override the rights and freedoms of the individual.
Public task
In some circumstances, we may process information where this is necessary for tasks linked to public functions, such as commissioned care, safeguarding or working with public authorities. Whether this basis applies will depend on the specific circumstances.
Consent
We may rely on consent where this is appropriate and where the person has a genuine choice. This may include some types of marketing, optional newsletters, photographs, videos, publicity, case studies or optional participation in surveys or events.
Where we rely on consent, you can withdraw your consent at any time.
Special category data
Because halow provides adult social care, we may process special category data.
This may include information about:
- health
- disability
- care and support needs
- medication
- mental capacity
- safeguarding
- behaviour support
- risk
- personal care
- communication needs
- other sensitive information relevant to providing care and support
When we process special category data, we must have both a lawful basis under Article 6 of UK GDPR and a special category condition under Article 9 of UK GDPR.
The Article 9 conditions we may rely on include:
- provision of health or social care
- reasons of substantial public interest, including safeguarding
- vital interests, where someone is at risk of serious harm and cannot give consent
- explicit consent, where this is appropriate
- legal claims or legal obligations, where relevant
We will only use special category data where it is necessary, lawful and proportionate.
Safeguarding information
halow may need to collect, record and share safeguarding information where there are concerns about abuse, neglect, exploitation, harm or risk.
This may include information from the person we support, staff, families, advocates, local authorities, health professionals, police, emergency services or other agencies.
Where there is a safeguarding concern, we may need to share relevant information without consent if this is necessary to protect the person or others, comply with a legal duty, support an investigation, or work with safeguarding authorities.
We will only share the information that is necessary for the safeguarding purpose.
Sharing information
As an adult social care provider, halow must be clear that sharing information is sometimes necessary, lawful and expected as part of providing safe care and support.
We may share relevant information with:
- local authorities and commissioning teams
- social workers and care managers
- NHS services
- GPs and other health professionals
- safeguarding teams
- emergency services
- CQC and other regulators
- police, where necessary and lawful
- families, representatives, advocates, deputies or attorneys, where appropriate
- other care providers or professionals involved in a person’s support
- pharmacies
- IT providers and Nourish
- CRM systems, including Donorfy
- payroll, HR, finance and audit providers
- legal, insurance and professional advisers
- organisations involved in fundraising, events, communications or service delivery, where appropriate
We will only share information where there is a lawful reason to do so and where the information shared is necessary and proportionate.
We have agreements in place with service providers who process personal information on our behalf, to help protect personal data and make sure it is handled appropriately.
We may also disclose or share personal information where we are under a duty to do so in order to comply with a legal obligation, enforce or apply our terms and conditions or other agreements, protect the rights, property or safety of halow project, people we support, staff, volunteers, customers, donors or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection, safeguarding, regulatory compliance, legal claims or risk management.
Families, advocates and representatives
Where appropriate, halow may communicate with families, advocates, representatives, deputies, attorneys or others involved in a person’s care and support.
However, we will always consider the person’s rights, wishes, confidentiality, mental capacity and best interests when deciding what information can be shared.
Where a person has capacity to make decisions about their information, their wishes will be respected unless there is another lawful reason to share information, such as safeguarding, serious risk, legal duty or regulatory requirement.
Where we store your personal data
halow project is committed to ensuring the security of your information. We have physical, electronic and managerial procedures in place to secure and store personal information.
Personal information may be stored in secure electronic systems, digital care planning systems, CRM systems, HR systems, finance systems, email systems, paper files or other secure records.
Any information you provide that is securely stored with us may be held on relevant systems, including our external CRM Donorfy system, Nourish and other secure platforms used by halow.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect personal data, we cannot guarantee the security of data transmitted to our website. Any transmission is at your own risk.
Once we receive your information, we will use appropriate procedures and security features to try to prevent unauthorised access.
Retention of records
halow will only keep personal information for as long as necessary.
Different types of records may need to be kept for different periods, depending on the type of information, the reason it is held, legal duties, regulatory requirements, safeguarding issues, insurance requirements, contractual requirements and good practice.
Care and support records will be kept in line with halow’s Data Retention Schedule. As a guide, adult social care records may be retained for a period after support has ended, for example up to 7 years, unless a longer period is required because of safeguarding, complaints, legal claims, insurance, regulatory requirements or other legitimate reasons.
Staff, volunteer, finance, fundraising, donor, website and organisational records may have different retention periods.
Where information is no longer required, it will be securely deleted, destroyed or anonymised.
Your rights
You have rights under data protection law. These include:
- the right to be informed about how your information is used
- the right to access personal information held about you
- the right to ask for inaccurate information to be corrected
- the right to ask for information to be erased in certain circumstances
- the right to ask for processing to be restricted in certain circumstances
- the right to object to processing in certain circumstances
- the right to data portability in certain circumstances
- the right to withdraw consent where consent is the lawful basis
- rights relating to automated decision-making and profiling, where applicable
- the right to complain if you are unhappy with how your information has been handled
These rights are not always absolute. There may be situations where halow cannot fully agree to a request, for example where we have a legal duty to keep information, where information is needed for safeguarding, where information is needed for legal claims, or where information is required for regulatory reasons.
You can ask us what information we hold about you by contacting:
halow project
Carroll House
11 Quarry Street
Guildford
Surrey
GU1 3UY
Email: info@halowproject.org.uk
Please keep your information up to date by letting us know if the information we hold is incomplete or incorrect.
Right to erasure
You have the right to ask for your personal information to be deleted in certain circumstances. This is sometimes known as the “right to be forgotten”.
halow will consider all requests for erasure in line with UK GDPR and the Data Protection Act 2018.
There may be situations where we cannot delete information immediately or in full, for example where we need to keep information to meet legal, safeguarding, regulatory, contractual, insurance or care record requirements.
Where we can delete information, we will do so without undue delay.
Access to information
UK GDPR and the Data Protection Act 2018 give individuals the right to access personal information held about them.
This is known as a subject access request.
You can make a subject access request by contacting halow at the address or email above.
We may need to confirm your identity before responding. We will respond in line with the timescales set out in data protection law.
Complaints and the ICO
If you are unhappy with how halow has handled your personal information, please contact us first so that we can try to resolve your concern.
You also have the right to complain to the Information Commissioner’s Office, which is the UK regulator for data protection.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
ICO helpline: 0303 123 1113
Website: www.ico.org.uk
Data protection contact
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to:
Data Protection Lead
halow project
Carroll House
11 Quarry Street
Guildford
Surrey
GU1 3UY
Email: info@halowproject.org.uk
Data protection leads – Jonny Wells & Neil Wheeler
Website links
Our website may, from time to time, contain links to and from the websites of partner networks, advertisers, affiliates or other organisations.
If you follow a link to any of these websites, please note that those websites have their own privacy policies. halow does not accept responsibility or liability for those policies. Please check those policies before you submit any personal data to those websites.
Cookies
Our website uses cookies.
A cookie is a small file of letters and numbers that may be placed on your computer, phone or other device when you visit a website. Cookies allow us to distinguish you from other users of our website, improve your experience, understand how the website is used and help the website function properly.
We may use cookies to:
- identify you when you visit the website
- remember your preferences
- keep track of browsing patterns
- understand website traffic
- help improve the website
- support security and functionality
Most browsers allow you to turn off cookies. If you want to know how to do this, please look at the settings or help menu on your browser. Please note that turning off cookies may restrict your use of some parts of our website.
Where required, we will ask for your consent before using non-essential cookies.
Fundraising and communications
halow may use personal information to keep supporters, donors, families, professionals and others informed about our work, fundraising activities, events and services.
We will only send marketing or fundraising communications where we have a lawful basis to do so.
You can ask us to stop sending you marketing or fundraising information at any time by contacting:
halow project
Carroll House
11 Quarry Street
Guildford
Surrey
GU1 3UY
Email: fundraising@halowproject.org.uk
Changes to this privacy policy
Any changes we make to this privacy policy in the future will be posted on our website. Please check back periodically.
Where significant changes are made, we may take additional steps to inform people who are affected.
Accessible information
halow supports young adults and adults with learning disabilities and autism. We will aim to make information about privacy and data protection available in a way that is accessible and understandable.
An easy read version of this privacy notice is available for people we support.
Related legislation and guidance
This policy should be read in line with relevant legislation and guidance, including:
- UK General Data Protection Regulation
- Data Protection Act 2018
- Health and Social Care Act 2008
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014
- Care Act 2014
- Mental Capacity Act 2005
- relevant CQC guidance
- relevant ICO guidance
- halow’s internal data protection, safeguarding, confidentiality, care planning, records management and retention policies
Organisation details
halow project is registered as a charity in England and Wales.
Registered charity number: 1116773
Company limited by guarantee number: 05822301