Our commitment to your privacy

At Glendower Care Ltd, your privacy and the security of your personal information are important to us.
We are committed to protecting the personal information of the people we support, their families and representatives, employees, job applicants, healthcare professionals, commissioners, suppliers and anyone else who interacts with our services.

We handle personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection and privacy legislation.

We will:
 

• only collect and use personal information where we have a lawful reason to do so;

• only share personal information where necessary, appropriate and lawful;

• take appropriate measures to keep personal information secure;

• only retain personal information for as long as necessary or as required by law;

• respect your rights in relation to your personal information; and

• respond appropriately and promptly to requests or concerns regarding your personal information.
   

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who we may share it with, and the rights you have in relation to your personal information.

We may update this Privacy Policy from time to time. The latest version will always be available on our website.

Who we are

Glendower Care Ltd provides care and support services to individuals across the UK.

For the purposes of UK data protection legislation, Glendower Care Ltd will normally act as the data controller for the personal information described within this Privacy Policy. This means that we determine how and why your personal information is processed.

In some circumstances, we may process personal information on behalf of another organisation, such as a local authority, NHS organisation or commissioning body. Where this happens, our responsibilities will depend on the particular arrangement.

Our registered address is:

Glendower Care Ltd
Unit 18, Ffordd Richard Davies
St Asaph
Wales
LL17 0LJ

General enquiries: contact@glendowercareltd.com

Data protection and privacy requests: dpo@prosperogrp.com

What is personal information?

Personal information, also known as personal data, is any information relating to an identified or identifiable individual.
This can include information such as your:
 

• name;

• address;

• telephone number;

• email address;

• date of birth;

• identification details;

• employment information; and

• information relating to the care or services you receive.
   

Certain types of personal information are considered particularly sensitive and are known as special category data.

This can include information about your:
 

• physical or mental health;

• disabilities;

• racial or ethnic origin;

• religious or philosophical beliefs;

• sexual orientation;

• sex life;

• genetic information; and

• biometric information where used for identification.
   

We may need to process special category information where it is necessary to provide safe, appropriate and personalised care and support.
We may also process information relating to criminal convictions and offences where this is necessary and lawful, including in relation to safeguarding, recruitment and employment.


What information do we collect?

The information we collect will depend on your relationship with Glendower Care Ltd.

People receiving care and support

Where you receive care or support from us, we may collect information including:
 

• your name and contact details;

• date of birth;

• emergency contact and next-of-kin information;

• information about family members, representatives or advocates;

• health and medical information;

• information about disabilities and support needs;

• care assessments and care plans;

• medication information;

• information about mobility, communication and accessibility requirements;

• dietary requirements and allergies;

• risk assessments;

• safeguarding information;

• incident and accident records;

• records relating to the care and support we provide;

• information about your preferences, routines and personal circumstances;

• information supplied by healthcare professionals, local authorities or other organisations involved in your care; and

• financial or payment information where relevant.
   

We aim to collect only the information that is necessary for the services we provide.

Family members, representatives and advocates

We may collect names, contact information and other relevant details about family members, carers, representatives, advocates or other individuals involved in supporting someone receiving our services.

Employees and job applicants

Where you work for us or apply to work for us, we may collect information including:
 

• contact information;

• CVs and employment history;

• qualifications and professional registrations;

• references;

• right-to-work information;

• Disclosure and Barring Service (DBS) information where appropriate;

• training and competency records;

• payroll and banking information;

• attendance and employment records;

• performance information; and

• health or occupational health information where appropriate.
   

Additional information about how employee information is handled may be provided separately to employees.

Website visitors and enquiries

When you visit our website or contact us, we may collect information including:
 

• your name;

• email address;

• telephone number;

• information submitted through website forms;

• correspondence with us;

• technical information about your device or browser; and

• information collected through cookies and similar technologies.
   

Further information about our use of cookies may be provided within our Cookie Policy.

How do we collect your information?

We may collect personal information directly from you when you:
 

• contact us;

• enquire about our services;

• complete an assessment or registration form;

• receive care or support from us;

• apply for a job;

• work for us;

• use our website;

• communicate with members of our team; or

• otherwise provide information to us.
   

We may also receive information from third parties where it is lawful and appropriate to do so.

These may include:
 

• family members and representatives;

• local authorities;

• NHS organisations and healthcare professionals;

• social workers;

• commissioners;

• hospitals;

• GPs and other healthcare providers;

• previous care providers;

• safeguarding authorities;

• regulatory bodies;

• recruitment agencies;

• referees; and

• other organisations involved in providing or coordinating your care and support.
   

How do we use your personal information?

We may use personal information to:
 

• assess your care and support needs;

• develop and maintain personalised care plans;

• provide safe and appropriate care and support;

• monitor and review the services we provide;

• manage medication and health-related requirements;

• communicate with you and, where appropriate, your family or representatives;

• coordinate care with healthcare professionals, local authorities and other organisations;

• respond to enquiries;

• manage safeguarding concerns;

• investigate accidents, incidents and complaints;

• maintain appropriate care and operational records;

• meet regulatory and legal requirements;

• recruit and manage employees and workers;

• process payments and manage our financial obligations;

• improve our services;

• maintain the security of our services, systems and premises; and

• establish, exercise or defend legal claims where necessary.
   

We will not use your personal information for purposes that are incompatible with the purposes for which it was originally collected unless we have a lawful basis for doing so.

Our lawful basis for processing your information

Under UK data protection legislation, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may process your information because:
 

• Contract: processing is necessary to perform a contract with you or to take steps before entering into a contract.

• Legal obligation: processing is necessary for us to comply with a legal or regulatory obligation.

• Vital interests: processing is necessary to protect someone's life.

• Legitimate interests: processing is necessary for our legitimate interests, or those of another organisation, provided those interests are not overridden by your rights and interests.

• Consent: you have given us clear consent to process your personal information for a specific purpose.
   

Where we process special category information, including information about your health, we will also ensure that an appropriate additional condition for processing that information applies.

For example, health information may need to be processed where this is necessary for the provision or management of health or social care.
We do not rely on consent where another lawful basis is more appropriate. Where we do rely on your consent, you have the right to withdraw that consent at any time.

Who do we share personal information with?

We will only share personal information where there is an appropriate and lawful reason for doing so.

Depending on the circumstances, we may share information with:
 

• NHS organisations;

• GPs and other healthcare professionals;

• local authorities;

• social workers;

• commissioners and funding organisations;

• hospitals and other care providers;

• safeguarding teams and authorities;

• emergency services;

• regulatory bodies;

• professional advisers;

• insurers;

• payroll, HR and pension providers;

• IT and software providers;

• payment processors;

• auditors;

• legal advisers; and

• other organisations involved in providing, managing or funding your care.
   

We may also disclose information where required or permitted by law, including where necessary to protect an individual from harm, investigate suspected criminal activity or respond to a lawful request from a public authority.

Where third-party organisations process personal information on our behalf, we take appropriate steps to ensure they protect that information and use it only for the agreed purposes.

We do not sell your personal information to third parties.

If Glendower Care Ltd undergoes a restructuring, merger, acquisition or transfer of part of its business, personal information may be transferred as part of that transaction where lawful and appropriate.

International transfers

We aim to store and process personal information within the UK wherever reasonably practicable.

However, some of the organisations and technology providers we use may store or process information outside the UK.

Where personal information is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable UK data protection legislation.
Where required, we will put appropriate safeguards in place to ensure that your personal information receives an appropriate level of protection.

How long do we keep your information?

We will only retain personal information for as long as necessary for the purposes for which it was collected, including satisfying legal, regulatory, safeguarding, accounting and reporting requirements.

Different types of information may need to be retained for different periods.

When determining appropriate retention periods, we consider factors including:
 

• the nature and sensitivity of the information;

• why the information was collected;

• legal and regulatory requirements;

• safeguarding requirements;

• contractual obligations; and

• whether the information may be required in connection with legal claims.
   

Once personal information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our data retention procedures.

How do we keep your information secure?

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure or destruction.
These measures may include:
 

• secure IT systems;

• access controls and password protection;

• restricting access to personal information to authorised personnel;

• staff training;

• secure storage and disposal procedures;

• appropriate arrangements with third-party service providers; and

• procedures for responding to suspected personal data breaches.
   

Employees and other authorised individuals who have access to personal information are required to maintain confidentiality and handle information in accordance with our policies and procedures.

While we take appropriate measures to protect information transmitted electronically, no internet-based system can be guaranteed to be completely secure.

Your data protection rights

Under UK data protection legislation, you have a number of rights in relation to your personal information.

Depending on the circumstances, these may include:
 

• The right to be informed – you have the right to understand how your personal information is collected and used.

• The right of access – you can request a copy of the personal information we hold about you.

• The right to rectification – you can ask us to correct inaccurate or incomplete personal information.

• The right to erasure – you can ask us to delete your personal information in certain circumstances.

• The right to restrict processing – you can ask us to restrict how we use your information in certain circumstances.

• The right to object – you can object to certain types of processing.

• The right to data portability – in certain circumstances, you can ask us to provide your personal information in a structured, commonly used and machine-readable format or transfer it to another organisation.

• Rights relating to automated decision-making and profiling – you have rights relating to certain decisions made solely through automated processing.
   

Where we rely on your consent to process personal information, you also have the right to withdraw that consent at any time.

These rights are not absolute and may be subject to exemptions or restrictions under applicable data protection legislation.

Requesting access to your information

You can ask us for a copy of the personal information we hold about you by submitting a Subject Access Request (SAR).
Requests should be sent to:

dpo@prosperogrp.com

We may need to ask you for information to confirm your identity before responding to your request. We will only request information that is necessary to verify your identity.
We will respond to valid requests within the timescales required by applicable data protection legislation.

You will not normally be charged for making a request, although data protection legislation allows us to charge a reasonable fee or refuse a request in certain limited circumstances.

Correcting or deleting your personal information

If you believe that personal information we hold about you is incorrect or incomplete, you can ask us to correct it.
You may also ask us to delete personal information we hold about you.

The right to deletion is not absolute. There may be circumstances where we are legally, professionally or regulatorily required to retain certain information, including care records, safeguarding records, financial information or employment records.

Where we are unable to delete information following a request, we will explain the reason where appropriate.

Requests relating to your personal information can be sent to:

dpo@prosperogrp.com

Marketing

We may occasionally contact you with information about Glendower Care Ltd and our services where we are legally permitted to do so.
Where consent is required for marketing communications, we will obtain it before contacting you.

You can opt out of receiving marketing communications from us at any time by using the unsubscribe option provided in our communications or by contacting us at:
contact@glendowercareltd.com

Opting out of marketing communications will not affect essential communications relating to care or services you receive from us.

Cookies and our website

Our website may use cookies and similar technologies to improve functionality, understand how visitors use our website and, where applicable, support analytics and marketing activities.

Some cookies are necessary for our website to function correctly. Other cookies will only be used where we have obtained any consent required by applicable law.
You can manage your cookie preferences through the cookie controls available on our website.

Further information about the cookies we use and their purposes can be found in our Cookie Policy.

Complaints, concerns and data protection enquiries

If you have any questions or concerns about how Glendower Care Ltd collects, uses or protects your personal information, please contact us in the first instance.

Glendower Care Ltd
Unit 18, Ffordd Richard Davies
St Asaph
Wales
LL17 0LJ

General enquiries: contact@glendowercareltd.com

Data protection and privacy requests: dpo@prosperogrp.com

If you wish to exercise any of your data protection rights, including requesting access to, correction of, or deletion of your personal information, please contact us using the data protection email address above.

We will investigate concerns relating to the use of personal information and respond in accordance with applicable data protection legislation.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection and information rights.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, business practices, technology or legal and regulatory requirements.
Any changes will be published on our website. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.

The most recent version of this Privacy Policy will apply to the personal information we hold.
Last updated: July 2026