Privacy Policy
1. Introduction and company information
This Privacy Policy explains how Brightway Community Services Ltd collects, uses, stores, shares, and protects personal data when providing its services and operating its business as a local service provider in the United Kingdom.
Brightway Community Services Ltd is the data controller responsible for your personal data in connection with this policy.
Company name: Brightway Community Services Ltd
Address: Brightway Community Services, 18 Castle Street, Newcastle upon Tyne, NE1 2SE, United Kingdom
Email: [email protected]
Phone: +44 191 482 7593
This Privacy Policy should be read together with any additional notices we provide when collecting personal data for a specific service, event, or activity.
2. Data collection and processing
We may collect and process the following categories of personal data, depending on your interactions with us:
- Identity data: name, title, date of birth, and similar identifiers.
- Contact data: address, email address, telephone number, and emergency contact details where relevant.
- Service-related data: information you provide when requesting or receiving our community services, including preferences, support needs, appointments, notes, and communication history.
- Financial and transaction data: billing details, payment records, and related administrative information, where applicable.
- Technical data: IP address, browser type, device information, and website usage data if you interact with our website or digital services.
- Communication data: records of correspondence by email, telephone, forms, or other channels.
- Special category data: where necessary and permitted by law, information concerning health, support needs, or other sensitive information relevant to the services we provide.
We collect personal data directly from you, from your authorised representatives, from referral partners, from service providers acting on our behalf, and from publicly available or third-party sources where lawful and appropriate.
We only process personal data that is necessary for our legitimate business and service purposes, or where required by law.
3. Purpose of data processing
We process personal data for the following purposes:
- to provide, manage, and improve our community services;
- to communicate with you about enquiries, appointments, and service updates;
- to assess suitability for services and support needs;
- to maintain accurate records and manage administration;
- to process payments, invoices, and related financial matters;
- to meet legal, regulatory, tax, and accounting obligations;
- to protect the safety, security, and wellbeing of service users, staff, and visitors;
- to monitor and improve the quality of our services;
- to manage complaints, feedback, and dispute resolution;
- to send essential notices and, where permitted, service-related communications;
- to operate and secure our website, systems, and premises.
4. Legal basis for processing
We process personal data only where we have a lawful basis to do so under applicable data protection law. Depending on the circumstances, our legal bases may include:
- Consent: where you have given clear consent for a specific purpose.
- Contract: where processing is necessary to enter into or perform a contract with you.
- Legal obligation: where processing is necessary to comply with our legal duties.
- Vital interests: where processing is necessary to protect someone’s life or safety.
- Legitimate interests: where processing is necessary for our legitimate business interests and those interests do not override your rights and freedoms.
- Public task or official function: where applicable and relevant to the services we provide.
- Special category data conditions: where required, we rely on additional lawful conditions for processing sensitive information.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Data sharing and third parties
We may share personal data with third parties only where necessary and lawful. These may include:
- service providers and suppliers who support our operations, such as IT, hosting, email, communication, and administrative providers;
- payment processors and financial service providers;
- professional advisers, including accountants, auditors, insurers, and legal advisers;
- partner organisations, referral agencies, or commissioning bodies involved in delivering or coordinating services;
- regulators, public authorities, courts, law enforcement, or other bodies where required by law;
- emergency services or medical professionals where necessary to protect health or safety.
We require third parties to handle personal data securely and only for the agreed purposes, subject to appropriate contractual and legal safeguards.
6. Data transfer to third countries
We primarily store and process personal data in the United Kingdom. If personal data is transferred outside the United Kingdom or the European Economic Area, we will take appropriate steps to ensure an adequate level of protection in accordance with applicable law.
Such safeguards may include adequacy decisions, standard contractual clauses, international data transfer agreements, or other lawful transfer mechanisms. You may contact us for further information about any such transfers and the safeguards applied.
7. Storage duration
We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, reporting, and operational requirements.
Retention periods depend on the type of data and the reason it is held. In general, we consider:
- the nature and sensitivity of the information;
- the duration of your relationship with us;
- legal and regulatory retention requirements;
- the limitation periods for potential claims;
- the need to resolve disputes, complaints, or operational issues.
When personal data is no longer needed, it will be securely deleted, anonymised, or otherwise disposed of in accordance with our retention procedures.
8. User rights
Subject to applicable law, you may have the following rights in relation to your personal data:
- Access: to request confirmation of whether we process your personal data and to obtain a copy of it.
- Rectification: to request correction of inaccurate or incomplete personal data.
- Erasure: to request deletion of your personal data in certain circumstances.
- Restriction: to request limitation of processing in certain situations.
- Data portability: to request that certain data be provided in a structured, commonly used, machine-readable format or transferred to another controller, where applicable.
- Objection: to object to processing based on legitimate interests or for direct marketing purposes, where applicable.
To exercise any of these rights, please contact us using the details in the Contact Information section. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.
9. Withdrawal of consent
Where we rely on your consent to process personal data, you may withdraw that consent at any time by contacting us at [email protected] or by writing to our postal address.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received. In some cases, if you withdraw consent, we may no longer be able to provide certain services or features to you.
10. Right to complain
If you have concerns about how we use your personal data, please contact us first so we can try to resolve the matter.
You also have the right to lodge a complaint with the relevant data protection supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO).
ICO website: www.ico.org.uk
11. Data security
We use appropriate technical and organisational measures to protect personal data against accidental loss, misuse, unauthorised access, disclosure, alteration, or destruction.
These measures may include access controls, staff confidentiality obligations, secure storage, encryption where appropriate, regular system updates, and staff training. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Where a personal data breach occurs and we are legally required to do so, we will notify the relevant authority and affected individuals.
12. Contact information
If you have any questions about this Privacy Policy, your personal data, or how we handle information, please contact:
Brightway Community Services Ltd
Brightway Community Services, 18 Castle Street, Newcastle upon Tyne, NE1 2SE, United Kingdom
Email: [email protected]
Phone: +44 191 482 7593
13. Changes to privacy policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or operational needs. Any revised version will be posted with an updated effective date where appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how Brightway Community Services Ltd protects your personal data.