Privacy Notices for Learners, Families and Staff

1. Purpose

Everyone whose information we hold has a right to know what we do with it. This policy sets out how we tell them clearly, at the right time and in a form they understand. Appendices A to C are the notices. They follow the Data Protection, Retention and Information Sharing policy (policy 17); if they ever differ, policy 17 applies and the Director corrects the notice.

2. Scope

The notices cover learners (Appendix A, for 11 to 16 year olds), parents and carers (Appendix B), and everyone who works, volunteers or applies to work in the provision (Appendix C), for every AP learner whoever commissions the place. Short notices for visitors and website users follow the same rules.

3. Law and guidance

• UK GDPR, Articles 12 to 22: notices must be concise and in plain language, especially for children. Where information comes from someone else, such as a referring school, the notice is due within a reasonable period and at most one month, or at first contact if sooner.

• Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025: from 19 June 2026 complaints are accepted in any form, acknowledged within 30 days and investigated without undue delay, with the complainant kept updated and told the outcome.

• ICO guidance: age-appropriate language for children, considering whether a child is competent to use their own rights.

• Keeping Children Safe in Education 2026 and the Equality Act 2010 (reasonable adjustments for disabled people).

• Our contracts with commissioning local authorities: Care Cove and the commissioning local authority are independent controllers.

4. Roles and responsibilities

5. How and when the notices are given

We tell people before using their information for any new purpose.

6. Making the notices clear

• The key mentor reads the learner notice with the learner in the way their plan suggests (for example visuals or easy read), and records on Connect if they need more help to use their rights.

• Families who need it get a translated notice or a professional interpreter, never a child. Large print and easy read are always available.

7. Keeping the notices up to date

The Director reviews the notices every year, and sooner after any change in processing (such as a new system, partner or sharing arrangement), a change in law, or a complaint showing a notice is unclear. Changes are shared through the Family portal and Student app and briefed to staff.

8. Requests and complaints

Requests follow section 13 of policy 17, and complaints section 15: acknowledged within 3 working days and normally answered in writing within one month. Freedom of Information requests go to the commissioning local authority within 2 working days and are never answered directly.

9. Monitoring and review

Each month the Administrator checks that every new learner, parent and member of staff has a recorded notice date. The SWMC termly audit samples these records. This policy is reviewed every year, or sooner after a complaint, breach, change in law or contract change.

10. Related policies

• 02 Safer Recruitment
• 14 Therapeutic Practice and Clinical Governance
• 17 Data Protection, Retention and Information Sharing
• 19 Complaints
• 28 Site Security, Visitors and CCTV
• 35 Photography, Images and Social Media

Appendix A: Privacy notice for learners

Who we are. We are Care Cove Limited. We run Care Cove Alternative Provision at 37 Townhead Street, Sheffield, S1 2EB. Email: hello@carecove.co.uk. Our Director is in charge of looking after information. You can ask any member of staff about this notice.

What we know about you.

• Your name, date of birth, address, school and who looks after you.

• What your school or council told us, and your attendance, work, progress and plan.

• Your health, such as allergies, medicines and what you eat.

• When you see your counsellor and whether there are worries. Not what you talk about.

• Worries about your safety, and incidents.

• What you do on Care Cove laptops. We filter and check them to keep you safe.

• CCTV, never in toilets or therapy rooms.

• Photos of you, only if you and your parent agree.

Why we use it. The law says we need a good reason, called a lawful basis.

• To teach and support you: your school or council asked us to (a "public task"), or we have a "legitimate interest" in running your place.

• To keep you and others safe: always a good enough reason.

• In an emergency: to protect your life ("vital interests").

• Photos online or in leaflets: only with your "consent" and your parent's.

Extra-private things, like your health, ethnicity, religion or anything to do with crime, get extra care. Only staff who need them can see them.

Who we share it with.

Exam centres, work placements and taxi firms get only what they need. What you say in counselling stays private unless your counsellor is worried someone could be harmed. We never sell your information, and computers never make decisions about you on their own.

Where we keep it. On Care Cove Connect, our secure system, stored in the UK. Only staff who need it can see it.

How long we keep it.

• Learning record: 3 years after you leave, or until we check how you are doing 18 months after leaving, if later.

• Safeguarding file: sent to your school's safeguarding lead when you leave; our copy is kept until you are 25.

• Health and accident records: until you are 25.

• Your counsellor's private notes: until you are 25, or 26 if you were 17 when counselling ended.

• Attendance registers: 6 years, because they show what was paid for.

• CCTV: deleted automatically after a short time, unless needed for an incident.

Your rights. You can ask to see your information, correct it, delete it or stop us using it (sometimes we must keep it to keep you safe), and change your mind about photos. If you disagree with something we wrote, we add your view. Most young people your age can ask for themselves; your parent can ask for you if you agree. We reply within one month.

If you are unhappy. Tell any member of staff, use the Student app or email us. The Director looks into it (or the Chair of our Social Work Management Committee if it is about the Director). We tell you we have your complaint within 3 working days (the law says within 30 days), keep you updated and tell you what we found, usually within one month. You can also contact the Information Commissioner's Office: ico.org.uk or 0303 123 1113.

Appendix B: Privacy notice for parents and carers

Who we are. Care Cove Limited (company number 14676553), 37 Townhead Street, Sheffield, S1 2EB, controls this information. Contact the Director, our data protection lead, at hello@carecove.co.uk (marked "Data protection") or 07879 818254.

What we collect. About your child: contact details; referral information (education, special educational needs, risks, social care involvement); assessments, plans and attendance; incidents, physical interventions and searches; safeguarding concerns; health, medication, allergies and diet; therapy session records (date, length, risk flags and themes, never session content); post-16 destination; device monitoring; CCTV; and photographs with consent. About you: name, relationship, parental responsibility, contact details, any court orders or contact restrictions, language needs, survey answers and Family portal messages.

Why we use it and our lawful basis.

We never use this information for marketing or make decisions by solely automated means.

Who we share it with.

The exam centre, placement employers and taxi operators receive only what their task needs. Our Social Work Management Committee and external safeguarding auditor may see records when checking our practice. AP records are not shared with Care Cove Short Breaks or Dreams Are Real CIC unless there is a lawful reason such as safeguarding.

Where it is kept. On Care Cove Connect, hosted in the UK by our processor, with role-based access and an audit log.

How long we keep it. Education record (including therapy session records and your details): 3 years after the placement ends, or until the 18-month destination follow-up is complete if later. Safeguarding file: sent to the main or receiving school's DSL when the placement ends; our copy kept until your child's 25th birthday. Health, medication and accident records: until the 25th birthday. Counsellors' clinical notes: until the 25th birthday, or 26th if your child was 17 when therapy ended. Attendance registers: 6 years from the end of the contract year. Complaints: 6 years after closure. CCTV: overwritten automatically unless saved for an incident. For learners placed by a commissioning local authority, records are kept only for as long as the law and our contracts require.

Your rights. You can ask for a copy of your information, have it corrected, and in some cases erased, restricted or moved, object to its use, or withdraw consent. You can ask on your child's behalf where your child agrees or cannot decide. We may withhold information where the law allows, for example to prevent serious harm. We reply free within one month (up to two months more for complex requests), and forward requests about the commissioning local authority's own records to it within 5 working days.

Complaints. Please come to us first, in any form: email, post, phone, in person or the Family portal. We acknowledge within 3 working days (the law requires within 30 days), investigate without undue delay, keep you updated and aim to give a written outcome within one month. The Director investigates, or the Chair of our Social Work Management Committee if it concerns the Director. You can also complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.

Appendix C: Privacy notice for staff, volunteers and job applicants

Who we are. Care Cove Limited, 37 Townhead Street, Sheffield, S1 2EB, hello@carecove.co.uk, is the controller. This notice covers everyone who works, volunteers or applies to work in the provision, including agency and partner staff.

What we collect. Application details, references, interview notes, online searches on shortlisted candidates and criminal record self-declarations; identity, right to work, Enhanced DBS with barred list, prohibition, section 128 and overseas checks, and qualifications; contract, pay, tax, pension and emergency contacts; absence, health and adjustments; training and supervision; any grievance, disciplinary matter, low-level concern or allegation; optional equality monitoring; Connect audit logs, device monitoring, sign-in and CCTV.

Why we use it and our lawful basis.

Who we share it with. The commissioning local authority (staff information on request, and any misconduct allegation affecting a learner with the investigation report); the LADO, police and Sheffield Safeguarding Hub where safeguarding requires; the Disclosure and Barring Service and Teaching Regulation Agency; your agency or employing partner; referees; HMRC, our pension provider, insurers and payroll service; training providers; and the Social Work Management Committee and external safeguarding auditor.

Where it is kept. On Care Cove Connect, hosted in the UK.

How long we keep it.

Your rights and complaints. You can see, correct, and in some cases erase, restrict or move your information, object, and withdraw consent; we reply within one month. Complain to the Director first, or the Chair of the Social Work Management Committee if it concerns the Director. We acknowledge within 3 working days (the law requires within 30 days), investigate without undue delay, keep you updated and aim to give a written outcome within one month. You can also complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.

Document control and ratification

This policy is signed off by the Designated Safeguarding Lead and the Head of Alternative Provision, and ratified by the Social Work Management Committee. It is reviewed every year, or sooner after an incident or a change in law, statutory guidance or contract requirements, and it is available to any commissioning local authority on request.