Privacy Policy

Contact for Information Governance & Compliance: compliance@ageukcornwall.org.uk

This Privacy Notice explains how Age UK Cornwall & The Isles of Scilly (AUKCIOS) collects, uses, shares and protects personal information in accordance with UK data protection law. It applies to all individuals who use our services, interact with us, or otherwise provide us with personal information.

AUKCIOS is the data controller for the information we process, unless stated otherwise for specific commissioned services (e.g., WorkWell, where the Department for Work and Pensions is the overall controller for evaluation data).

We are committed to processing information lawfully, fairly and transparently, and to ensuring individuals understand how their data is used and what rights they have.

1. What information we collect

We collect only the information necessary to deliver our services and fulfil our legal and contractual obligations. This may include:
• Name, address, date of birth and contact details.
• Information about your circumstances, support needs, accessibility requirements and next of kin.
• Records of your interactions with us (e.g., calls, emails, service notes).
• Special category data such as health information, where relevant and proportionate to the support being provided.

We collect information directly from you, through referrals made with your knowledge, or through secure commissioning arrangements.

2. How we use personal information

We use information for the following purposes:

Service delivery and coordination: to assess needs, provide support, and work with partner organisations involved in your care. We may rely on consent, contract, legitimate interests or vital interests depending on the circumstances. For health data, we rely on Article 9(2)(h) (health or social care) or explicit consent.

Safeguarding and prevention of harm: where there is risk of significant harm, information may be shared with professionals involved in your care for multi‑disciplinary decision‑making. Lawful bases may include vital interests, legal obligation or substantial public interest conditions under the Data Protection Act 2018.

Monitoring, reporting and funding requirements: we may use anonymised or aggregated information to evidence activity to commissioners and funders.

Research and evaluation: see Section 4.

We do not use personal data for direct marketing.

3. Who we share information with

We never sell personal information. We share information only where necessary, lawful, and subject to appropriate safeguards.

Cornwall NHS bodies: We share anonymised or aggregated data for population health and public health management. This data does not identify individuals.

Partner organisations involved in providing support: Identifiable data is shared only with your explicit consent.

Safeguarding or best‑interest MDT meetings: Where necessary to prevent risk or harm, we may share identifiable information with relevant professionals.

WorkWell programme – DWP and IFF Research: AUKCIOS does not share any identifiable data directly with IFF. DWP is the overall data controller for evaluation. DWP may share only your name and contact details with IFF so they can request your explicit consent to take part in research. You will not be included unless you consent.

4. Research and evaluation

We support research that contributes to improving services and outcomes. Wherever possible, we provide anonymised or aggregated data. Where identifiable information is necessary, we rely on explicit consent or applicable research provisions under UK GDPR and the Data Protection Act 2018.

Research partners may include NHS Population Health Management Teams, University of Exeter, IFF Research, Unity Insights and other organisations commissioned by government or NHS bodies. Each project is subject to documented safeguards, role definitions, and minimisation of data shared.

Some partners, including AUKCIOS, are required to meet the NHS Data Security and Protection Toolkit (DSPT) standards.

5. How long we keep information

We retain personal information only for as long as necessary for the purposes it was collected, guided by legal, contractual and operational requirements.

WorkWell records are retained for 2 years, in line with contract requirements. Other records follow ICO best‑practice retention periods unless otherwise specified.

Individuals may request details of specific retention periods by contacting compliance@ageukcornwall.org.uk

6. Keeping information secure

We use appropriate technical and organisational measures to protect personal data. Access is restricted to trained staff, volunteers and contractors who require it to perform their roles.

We do not transfer personal data outside the UK. All systems used for storage and processing are located within the UK.

7. Your data protection rights

You have rights under UK data protection law, including the rights to:
• Access your personal data.
• Request correction of inaccurate information.
• Request erasure of your data (where applicable).
• Restrict or object to processing in certain circumstances.
• Withdraw consent where processing relies on consent.

To exercise your rights, contact us at compliance@ageukcornwall.org.uk. You may also complain to the Information Commissioner’s Office if you are unhappy with how your information is used.

8. Cookies and online technologies

Our website uses Google Analytics to understand website use and improve our services. Users can manage optional cookies via our cookie preference tools. No chatbot is currently in use.

9. Contact and complaints

To ask questions or raise concerns about how we use your information, contact:
Information Governance & Compliance Email: compliance@ageukcornwall.org.uk

If you remain dissatisfied, you may complain to the Information Commissioner’s Office.