8. WHERE WE GET PERSONAL INFORMATION FROM

 

We may receive personal information from:

• The child or young person;​

• Parents, guardians, carers and family members;

• Placing authorities and potential placing authorities;

• Local authorities and local safeguarding partners;

• Social workers and independent reviewing officers;

• Schools, pupil referral units, education other than at school providers, virtual schools and education professionals;

• Health care providers, GPs, hospitals, CAMHS, therapists and other clinicians;

• Youth justice services, police and emergency services;

• Ofsted and other regulatory or public authorities;

• Courts, solicitors and legal representatives;

• Advocates, independent visitors and independent reviewing officers;

• Professional consultants and advisers;

• Staff, workers, agency workers, volunteers and contractors at the Home;

• Previous care providers, placements or support services;

• Employment agencies, referees, previous employers, DBS services, occupational health providers, professional regulators and training providers;

• Visitors, complainants, whistle-blowers or members of the public where relevant.

 

We may also create personal information ourselves through assessments, observations, records, reports, supervision, reviews, incident records, care planning, risk assessments, employment records and safeguarding records.

 

 

9. WHO WE SHARE INFORMATION WITH

 

We share personal information only where necessary and lawful.

 

Depending on the circumstances, we may share information with:

• Placing authorities and local authorities;

• Parents, guardians, carers and family members, where appropriate and safe;

• Social workers, independent reviewing officers and advocates;

• Social services and safeguarding partners;

• Schools, pupil referral units, EOTAS providers, virtual schools and education professionals;

• Specialist teachers and education support professionals;

• Healthcare providers, GPs, hospitals, CAMHS, therapists and clinical professionals;

• Emergency services;

• Police and youth justice services;

• Ofsted;

• Other regulators or public authorities;

• Courts, tribunals, legal bodies and professional advisers;

• Insurers and claims handlers;

• LADO, DBS and safeguarding bodies where relevant;

• HR, payroll, pension, occupational health and training providers;

• IT, case-management, secure storage, confidential waste and professional service providers acting on our behalf;

• Organisations involved in safeguarding, child protection, regulation, inspection, quality assurance or legal compliance.

 

We will not share more information than is necessary for the purpose.

 

Where another organisation decides how and why it uses personal information, that organisation will usually be a separate data controller. This includes placing authorities, local authorities, schools, health bodies, police, Ofsted and courts. Their own privacy information will explain how they use personal information.

 

Where suppliers process personal information on our behalf, we require them to protect the information, follow our instructions and meet data protection requirements.

 

 

10. SHARING INFORMATION WITH OFSTED

 

Ofsted regulates and inspects children’s homes in England.

 

We may share information with Ofsted where required or permitted by law, including for:

• Registration;

• Inspection;

• Monitoring;

• Enforcement;

• Complaints;

• Serious incident notifications;

• Regulation 40 notifications;

• Regulation 44 independent person visit reports;

• Regulation 45 quality of care review reports.

 

We may provide Ofsted with information about children, staff, managers, the Responsible Individual, visitors, incidents, safeguarding matters, complaints, care quality, staffing, suitability, compliance and other matters relevant to Ofsted’s functions.

 

Where information is included in Regulation 44 or Regulation 45 reports, we will take care to include information that is necessary, relevant and proportionate.

 

 

11. SAFEGUARDING AND INFORMATION SHARING

 

Safeguarding is a central part of our work.

 

We may share information without consent where this is necessary to:

• Protect a child or another person from harm or neglect;

• Protect a person’s physical, mental or emotional wellbeing;

• Respond to a medical or safeguarding emergency;

• Prevent, detect or report crime;

• Support a child-protection enquiry;

• Meet a legal or regulatory obligation;

• Support Ofsted, a local authority, police or another public authority carrying out statutory functions;

• Manage allegations, complaints, incidents or investigations;

• Establish, exercise or defend legal claims.

 

When sharing information, we will consider:

• The child’s best interests;

• The need to protect children and others from harm;

• Confidentiality;

• Proportionality;

• Accuracy;

• The rights and freedoms of others;

• Whether sharing can be limited to what is necessary;

• Whether the information should be shared urgently.

 

We complete data protection impact assessments where required, particularly for high-risk processing.

 

 

12. WHAT HAPPENS IF INFORMATION IS NOT PROVIDED

 

Some personal information is required so that we can assess referrals, provide safe care, meet statutory Children’s Home requirements, safeguard children and others, manage employment, and work effectively with professionals and public authorities.

 

If required information is not provided, we may be unable to:

• Assess a referral properly;

• Accept or continue a placement;

• Provide safe care;

• Meet statutory recording or safeguarding duties;

• Respond to safeguarding concerns;

• Work effectively with placing authorities or professionals;

• Employ or continue to employ a person;

• Complete safer-recruitment, DBS, right-to-work or suitability checks;

• Pay staff or administer employment benefits;

• Comply with legal, regulatory or contractual requirements.

 

Where information is optional, we will make this clear where appropriate.

 

 

13. HOW LONG WE KEEP INFORMATION

 

We keep personal information only for as long as necessary, taking account of legal, regulatory, safeguarding, employment, insurance and operational requirements.

 

We maintain a retention schedule. Some records must be kept for statutory periods. Other records are kept using retention criteria such as the seriousness of the matter, safeguarding relevance, limitation periods, regulatory requirements, employment obligations, insurance requirements and the rights and interests of the individuals involved.

 

13.1 Children’s Case Records

 

Children’s case records will be kept in accordance with the Children’s Homes (England) Regulations 2015.

 

These records must be retained for at least:

• 75 years from the child’s date of birth; or

• If the child dies before the age of 18, 15 years from the date of death.

 

If referral information becomes part of the child’s case record, it will be retained as part of that case record.

 

13.2 Other Children’s Home Records

 

Other Children’s Home records required under Schedule 4 of the Children’s Homes Regulations will be kept for at least 15 years from the date of the last entry, unless a longer period is required.

 

This may include records such as visitor records, staff duty rosters, fire drills, menus, sanctions, measures of control, accidents and other records required by the regulations.

 

13.3 Closure of the Home

 

If the Home closes, we will follow applicable Children’s Home requirements and Ofsted expectations for the secure transfer or retention of records.

 

Children’s case records may be transferred to another home operated by the provider or to the relevant local authority, as required. Schedule 4 records will be retained for the required period.

 

13.4 Referral Enquiries That Do Not Proceed

 

Referral enquiries and assessment records that do not result in a placement will normally be kept for up to 6 years after the referral decision, unless:

• The information is needed for safeguarding;

• The information is relevant to a complaint, investigation, legal claim or regulatory matter;

• A longer retention period is required by law or contract;

• The information becomes part of another statutory record.

 

13.5 Complaints, Incidents and Concerns

 

Complaints, incidents, concerns and investigation records will normally be kept for up to 6 years after closure.

 

Where the record forms part of a child’s case record or statutory Children’s Home record, the longer statutory retention period will apply.

 

Where the record relates to safeguarding, serious harm, allegations, legal claims, regulatory action or insurance matters, we may keep it for longer where necessary and lawful.

 

13.6 Safeguarding Allegations About Staff or Adults

 

Safeguarding allegations against staff will be recorded and managed through the Home’s safeguarding policy, HR procedures and LADO process.

​

False or malicious allegations will be removed from the staff member’s personnel record unless the staff member consents to retention and will not be included in references.

​

Substantiated, unfounded and unsubstantiated allegations will be retained on the staff file until normal pension age or for 10 years from the allegation, whichever is longer, unless a longer lawful retention period applies.

 

13.7 Staff and Employment Records

 

Staff personnel files will normally be kept for up to 6 years after employment or engagement ends, unless a longer period is required for safeguarding, pension, legal, regulatory or insurance reasons.

 

Payroll, tax and accounting records will normally be kept for at least 6 years.

 

Pension records may need to be kept for longer, depending on pension law, scheme rules and administration requirements.

 

Training, supervision and suitability records may be kept for as long as needed to evidence compliance with safer-recruitment, regulatory, safeguarding and Children’s Home requirements.

 

DBS certificate copies will not be kept longer than necessary and will be handled in line with applicable DBS and safer-recruitment requirements. We may retain audit information such as the date, certificate number, level of check and recruitment decision where lawful and necessary.

 

13.8 Recruitment Records

 

Recruitment records for unsuccessful candidates will normally be kept for up to 6 months after the recruitment decision, unless:

• The candidate consents to longer retention for future opportunities;

• The information is needed for a complaint, claim or investigation;

• Safeguarding or regulatory concerns require longer retention.

 

13.9 Visitor Records

 

Visitor records that form part of the Home’s statutory records will be kept for at least 15 years from the date of the last entry, unless a longer period is required.

 

13.10 CCTV and Access Records

 

Where CCTV or electronic access systems are used, images or logs will normally be kept for a short period, usually up to 30 days, unless they are needed for safeguarding, security, complaints, incidents, legal claims, insurance, regulatory matters or investigations.

 

CCTV will not be used in private areas such as bedrooms or bathrooms, except in exceptional circumstances where a lawful basis, safeguarding justification, risk assessment and appropriate safeguards are in place.

 

13.11 Website, Email and General Enquiries

 

General enquiries, website contact messages and routine correspondence will normally be kept for up to 12 months, unless the information becomes part of a referral, placement, complaint, safeguarding matter, contract, legal issue or statutory record.

 

 

14. SECURITY AND CONFIDENTIALITY

 

We protect personal information using appropriate technical and organisational measures.

 

These may include:

• Role-based access controls;

• Password protection and multi-factor authentication where available;

• Secure case-management and HR systems;

• Staff confidentiality obligations;

• Staff training;

• Secure storage of paper records;

• Secure disposal and confidential waste arrangements;

• Supplier due diligence and data-processing contracts;

• Audit trails and access monitoring where available;

• Incident reporting and data-breach procedures;

• Policies on safeguarding, records management, IT, confidentiality and information sharing.

 

We expect staff, workers, contractors and service providers to handle personal information confidentially and securely.

 

 

15. INTERNATIONAL TRANSFERS AND SUPPLIERS

 

We use secure IT systems, email, cloud storage, case-management systems, HR systems, payroll systems and professional service providers to support our work.

 

We do not routinely transfer personal information outside the UK unless this is necessary for the systems or services we use.

 

Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place. These may include:

• UK adequacy regulations;

• The UK International Data Transfer Agreement;

• The UK Addendum to approved standard contractual clauses;

• Another lawful transfer mechanism under UK data protection law.

 

Individuals can contact us using the details in this notice to ask for information about the safeguards used for international transfers.

 

 

16. AUTOMATED DECISION-MAKING AND PROFILING

 

We do not make decisions about children, placements, care, safeguarding, employment or suitability based solely on automated processing where the decision would have a legal or similarly significant effect.

 

We may use electronic systems to store information, flag tasks, support record keeping or help manage workflows, but decisions are made by appropriate people.

 

 

17. COOKIES, WEBSITE AND ONLINE SERVICES

 

Our website cookies notice is published separately.

 

Where online forms, email systems or digital portals are used, we will use personal information submitted through those systems for the purpose explained at the point of collection or in this notice.

 

 

18. HOW WE PROVIDE THIS NOTICE

 

We will make this notice available in appropriate ways, including where relevant:

• On request;

• During referral discussions;

• With referral or placement information;

• During professional onboarding or contract arrangements;

• During recruitment;

• During employment or engagement;

• Through staff policies or HR systems;

• Through visitor, complaints or correspondence processes;

• On our website or through other accessible formats.

 

Where we receive personal information from someone other than the individual, we will provide privacy information where required, unless an exemption applies or providing it would be impossible, disproportionate, prejudicial to safeguarding, or contrary to the rights and freedoms of others.

 

Children and young people receive a separate privacy notice.

 

 

19. YOUR DATA PROTECTION RIGHTS

 

Depending on the circumstances, individuals may have the right to:

• Ask for access to their personal information;

• Ask us to correct inaccurate or incomplete information;

• Ask us to delete information;

• Ask us to restrict how information is used;

• Object to certain uses of information;

• Ask for information to be transferred to them or another organisation;

• Withdraw consent, where we rely on consent;

• Complain about how we use personal information.

 

These rights do not apply in the same way in every situation. Some rights may be limited where information is needed for:

• Safeguarding;

• Statutory Children’s Home records;

• Legal obligations;

• Regulatory reporting;

• Ofsted inspection or enforcement;

• Employment obligations;

• Legal claims;

• Confidentiality;

• Crime prevention or detection;

• The rights and freedoms of others.

 

19.1 Right to Object

 

Where we rely on legitimate interests, recognised legitimate interest or public task, individuals may have the right to object to our use of their personal information.

 

We will consider objections carefully. We may continue to use information where we have compelling lawful reasons, including safeguarding, statutory records, regulatory obligations, legal claims, crime prevention, employment obligations, or the rights and freedoms of others.

 

19.2 How to Exercise Rights

 

Requests can be made by contacting:

Email: privacy@lemurcare.com
Phone: 0330 441 3000
Post: Lemur Care Limited, 163 Brighton Road, Coulsdon, Surrey, CR5 2YH

 

We may need to verify identity before responding to a request.

 

We will respond without undue delay and within the legal time limit. This is usually one month from receipt of the request, although the law allows an extension in some circumstances.

 

 

20. DATA PROTECTION COMPLAINTS

 

If you are concerned about how we use personal information, please contact us first using the details in this notice.

 

You can make a data protection complaint by emailing privacy@lemurcare.com, writing to the registered office, or contacting the Data Protection Officer.

 

Please mark your complaint “Data Protection Complaint”.

 

We will:

• Provide a clear way for people to make data protection complaints;

• Acknowledge data protection complaints within 30 days of receipt;

• Make appropriate enquiries;

• Take appropriate steps to investigate and respond;

• Keep the complainant informed where appropriate;

• Respond without undue delay;

• Explain the outcome of the complaint.

 

 

21. COMPLAINING TO THE ICO

 

Individuals can complain to the Information Commissioner’s Office if they are unhappy with how we use personal information or how we have handled a data protection complaint.

 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

 

Helpline: 0303 123 1113
Website: ICO website, Make a Complaint section

 

The ICO usually expects individuals to give the organisation an opportunity to respond before it considers a complaint.

 

 

22. CHANGES TO THIS NOTICE

 

We will review this privacy notice at least annually and sooner if there are significant changes to:

• The law;

• ICO guidance;

• Ofsted requirements;

• Our services;

• Our systems;

• Our suppliers;

• Our data-sharing arrangements;

• The way we use personal information.

 

When we make significant changes, we will take reasonable steps to bring the updated notice to the attention of those affected.

 

Last Updated: July 2026

Next Scheduled Review: July 2027, or sooner if required.