Website Privacy Notice

This notice explains how Step in Care Limited uses personal information when you visit stepincare.co.uk, contact us, submit an enquiry or register interest in a role. It covers website and initial enquiry processing. If you become a care client, worker or supplier, we will give you the privacy information for that relationship and its records.

Who is responsible?

The controller is Step in Care Limited (company number 12464573), referred to as “STEP”, “we”, “us” and “our”.

General enquiries: info@stepincare.co.uk
Data protection contact: Enhancial Digital Services, support@enhancial.com

Information we collect

Depending on how you use the website, we may collect:

• Care enquiries: your name and contact details; whether you are asking for yourself or another person; the care recipient’s name, your relationship, postcode, support requested and care-needs information you choose to enter.
• Staffing or vacancy enquiries: business contact details, organisation, role and information about the staffing need.
• Job or worker interest: contact details, work preferences, experience and information you choose to provide about your application.
• Correspondence: messages you send and our replies.
• Website and security information: device and browser details, IP address, pages and times visited, diagnostic and security logs, and cookie choices.

Please do not include detailed medical records, medication lists, identity documents or unnecessary information about another person in a general enquiry.

Why we use information and lawful bases

We use information to respond to enquiries, assess requested care or staffing support, arrange a conversation or assessment, consider applications, operate and secure the website, record cookie choices and meet legal obligations.

For personal data, including the Article 6 basis that applies alongside Article 9 for care enquiry information:

• UK GDPR Article 6(1)(b): steps at your request before a contract, where the person whose information is provided is the person seeking a service or role.
• Article 6(1)(f): our legitimate interests in responding to a representative or business contact, assessing a request made for another person, managing enquiries, protecting the website, preventing misuse and keeping proportionate business records. We rely on this where our interests are not overridden by your rights and expectations and, where required, document a legitimate interests assessment.
• Article 6(1)(c): compliance with a legal obligation where a specific law requires us to use the information.
• Article 6(1)(a): consent for optional analytics cookies and related analytics processing. You can withdraw this by changing your cookie choices.

Care enquiry information may reveal health or other special category data. Where needed to assess or arrange health or social care, we rely on Article 9(2)(h) UK GDPR and the health or social care condition in paragraph 2 of Schedule 1 to the Data Protection Act 2018, with the required duties of confidentiality. We limit this information to what is needed and restrict access to people who need it.

Who may receive information?

Information may be accessed by authorised STEP staff and service providers supporting website hosting, form delivery, email, security, consent management and analytics. Providers act under appropriate instructions and safeguards.

If you ask us to arrange care or staffing, we may share necessary information with a prospective care provider, staffing client, commissioner or other relevant organisation where needed to respond. We take account of your authority, the person’s wishes and confidentiality requirements. We may also disclose information where law requires it or to establish, exercise or defend legal claims.

International transfers

If STEP or a service provider processes personal data outside the United Kingdom, we use a transfer mechanism permitted by UK data protection law and appropriate safeguards. You can ask for details of the safeguard for a particular transfer at support@enhancial.com.

How long we keep information

We keep information only as long as needed and apply these website periods:

• Unconverted care, staffing and vacancy enquiries: 24 months after closure or last meaningful interaction, reviewed at 12 months; then securely deleted or anonymised.
• Enquiries leading to a client or business relationship: 6 years after the relationship ends or the last relevant financial transaction, whichever is later, unless a legal hold requires longer.
• Unsuccessful job or worker applicants: 6 months after the final decision. A separate talent-pool record is kept for 12 months only if you choose that option and STEP records the appropriate lawful basis.
• Routine correspondence not linked to another case: 12 months after the last substantive exchange. If it forms part of a contract, privacy-rights or incident case, that case’s period applies.
• Website and security access logs: 12 months from the event. Relevant extracts may be retained with an incident case.
• Cookie and consent-choice evidence: 24 months from your latest choice, then refreshed or deleted.
• Privacy-rights and data-protection incident cases: 6 years after case closure. Unnecessary identity or supporting documents are removed earlier.
• Google Analytics event and user-level data: 2 months. Analytics runs only after consent.

Care records created after a service starts are outside these website enquiry periods. Their retention is explained in the privacy information for that service.

Your rights

Depending on the circumstances, you may ask to access, correct, erase or restrict your personal data, object to processing based on legitimate interests, or receive certain data in a portable format. Where we rely on consent, you may withdraw it at any time; this does not affect earlier processing. Some rights have legal limits, including where we must keep information or need it for legal claims.

To exercise a right, email support@enhancial.com. We may need to verify identity and authority to protect the person whose information is involved. We aim to respond within one month, subject to lawful extensions for complex or multiple requests.

You may complain to the UK Information Commissioner’s Office at ico.org.uk. We would welcome the opportunity to address your concern first.

Security and children

We use technical and organisational safeguards suited to the information and risks. No internet transmission can be guaranteed completely secure, so send only information needed for your enquiry.

The website is not designed for children to submit personal information independently. A parent, guardian or authorised representative should make an enquiry for a child and provide only information needed to discuss support.

Changes and contact

We may update this notice when our processing changes. The effective date above identifies the current version.

General enquiries: info@stepincare.co.uk
Data protection enquiries and rights requests: support@enhancial.com