PRIVACY POLICY

Effective Date: June 2025
Contact: admin@cumbrianoutbound.co.uk

At Cumbrian Outbound, we are committed to protecting the privacy and personal information of everyone we work with whether you’re a young person in our care, a family member, a professional partner, or a website visitor. This privacy policy explains what personal data we collect, why we collect it, how we use it, and how we keep it safe.

It also outlines your rights under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018, and how you can exercise those rights.

We believe in transparency and accountability, so we encourage you to read this policy carefully and contact us if you have any questions or concerns about how your information is handled.

Who we are

At Cumbrian Outbound, we provide residential care services for children and young people. As the data controller, we are responsible for how your personal information is collected, stored, and used.

What data we collect

We gather personal information essential to our work, including contact details, referral data, assessments, care and medical records. To provide a safe online experience, we also use cookies and analytics tools to capture data like IP addresses and site usage patterns.

Why and how we use it

Your personal data helps us assess referrals, plan safe placements, communicate with stakeholders, and comply with our legal and safeguarding duties. We rely on legal bases such as contract performance, statutory compliance, and our legitimate interest in ensuring service quality and staff training. We do not use data for marketing or unrelated purposes.

Sharing and third parties

We may share personal information with placing authorities and statutory bodies, all operating under strict data-sharing agreements. We do not share your details with unrelated third parties.

Cookies and websites we link to

We use cookies to enhance your website experience and analyse usage. You can manage your cookie preferences through your browser settings. Our site may include links to external websites; we are not responsible for their privacy practices and encourage you to review their policies.

Data retention

We keep personal information only as long as necessary. Placement and care records are typically retained for up to 10 years after a young person leaves, in line with statutory guidance.

Your GDPR rights

Under GDPR, you have the right to access, correct, request deletion or restriction of your data, object to its processing, and request data portability. Where processing relies on consent, you can withdraw it at any time. To exercise any right or ask questions, email our Data Protection Lead at admin@cumbrianoutbound.co.uk. You can also raise a complaint with the ICO if needed.

Security and international transfers

We implement technical and organisational measures—such as encryption, secure servers, access controls, audits, and staff training—to ensure data security. We do not transfer data outside the UK or EEA unless appropriate safeguards (e.g. standard contractual clauses) are in place.

Children’s data

When processing data about children and young people, we use plain-language notices and, where appropriate, obtain consent, always in alignment with UK GDPR guidance.

Updates to this policy

We regularly review this policy to ensure it remains accurate and comprehensive. The latest version is published on our website along with the update date.