The Social Brokers NW CIC (“The Social Brokers”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information. We handle personal information safely, lawfully and fairly, in line with the UK GDPR and the Data Protection Act 2018.

This Privacy Policy explains what personal information we collect, why we need it, our lawful basis for using it, who we may share it with, how long we keep it and the rights you have over your information.

 

1. Who we are

The Social Brokers NW CIC is a Community Interest Company registered in England and Wales.

Company number: 15469737

Registered office: Top Floor, 26 Hope Street, Liverpool, L1 9BX

Website: https://thesocialbrokers.com

Email: connect@thesocialbrokers.com

Telephone: 0151 440 2400

For the purposes of UK data protection law, The Social Brokers NW CIC is the controller of the personal information described in this Privacy Policy. Any question about data protection can be sent to us using the details above and will be passed to our data protection lead.

 

2. What information we collect

Depending on how you interact with us, we may collect:

• your name, address, telephone number, email address, postcode and date of birth;

• household information, contact preferences and communication needs;

• information you provide in a message, enquiry, helpline call or form;

• information about vulnerability, disability, health, age-related needs, caring responsibilities or support needs, where this is relevant to the support you ask for (see section 5);

• provider information, such as your energy, water, utility, telecoms or housing provider and account details needed to complete an application;

• case notes, appointment notes, records of the support we provide and records of your consent;

• safeguarding, complaint or incident information, where necessary;

• information provided when you volunteer, apply to work with us, participate in an activity or work with us, including recruitment, emergency contact, training and payroll or expense information where applicable;

• information provided by partners where this is necessary for the delivery or administration of a project and you have agreed to it or another lawful basis applies;

• information contained in correspondence with us; and

• technical information about your use of our website, where applicable.

Please do not send health or other sensitive information through the general website contact form or by email unless we have specifically asked you to. If you need support that involves this kind of information, use our helpline or one of the support forms described in section 6.

 

3. How we collect your information

From you directly: by helpline, by completing an online form yourself, by completing a paper form directly with us, or by contacting us in person, by email or through our website.

From partners: GP surgeries, community organisations, housing providers, public bodies and other partners may tell you about our services. They may also refer you to us where you have agreed to this, or where a data sharing or referral agreement and another lawful basis applies.

From our website and systems: technical information about how the website is used, where applicable.

 

4. How we use your information and our lawful basis

We may use personal information to:

• respond to enquiries and requests;

• provide support services, including Priority Services Register (PSR) support, and keep records of the support we provide;

• provide information about our activities, projects and services;

• communicate with people participating in or enquiring about our programmes;

• organise and administer community activities, volunteering and events;

• work with schools, universities, local authorities, community organisations and other partners where necessary to deliver our work;

• monitor and evaluate our projects and services, and conduct research and evaluation where appropriate, using anonymised or aggregated information wherever possible;

• handle complaints and safeguarding concerns;

• improve our website, services and communications;

• maintain the security of our website and systems;

• comply with our legal and regulatory obligations; and

• protect the rights, safety and wellbeing of individuals involved with our work.

We will only use your information where we have a lawful basis to do so. The lawful bases we rely on are:

What we are doing	Lawful basis	Example
Providing support you ask for, and sharing your details with providers to complete an application	Consent	You complete the PSR support form or ask for help by helpline and agree to us using and sharing the necessary information.
Keeping proportionate records of support, follow-up calls and handling complaints	Legitimate interests	Recording what support we have given so we can follow up and deal with any complaint, where this does not override your rights.
Meeting legal and regulatory requirements	Legal obligation	Accounting records, employment records and other information we must keep by law.
Managing contracts	Contract	Supplier contracts and employment-related agreements.
Protecting someone from serious harm	Vital interests, or legal obligation	Sharing urgent information with emergency services or safeguarding bodies where a person is at immediate risk.

Where we rely on consent, you can withdraw it at any time (see section 7).

 

5. Special category information

Some of the support we offer, particularly PSR support, means we may ask for special category information. This is more sensitive personal information, and includes details about your health, disability, vulnerability or care needs.

We will only collect this information where it is necessary for the support you have asked for. We rely on your explicit consent, which we will ask for separately using clear wording. We will:

• only collect special category information that is directly relevant to the support being provided;

• avoid collecting detailed medical records unless they are genuinely necessary, and ask for a brief description of your support need where that is enough;

• restrict access to the staff or volunteers who need the information to support you; and

• not use special category information for marketing, profiling or any unrelated purpose.

6. Priority Services Register (PSR) support

The Priority Services Register helps energy, water and other essential service providers give extra support to people who need it. Our PSR support works like this:

• A GP surgery or other partner may tell patients or clients about the service. They will not give us a bulk patient list or a general patient contact database.

• You can contact us by helpline, complete the online form yourself, or complete a paper form directly with us.

• We hold your information only for PSR support and directly related administration, safeguarding, audit, complaint handling or legal compliance.

• We may share the minimum necessary information with the relevant energy, water, utility, telecoms or other essential service providers so that your PSR application can be completed.

• We keep a record of your consent, the provider we contacted, the date your information was submitted and the outcome, where known.

• We check key details such as your name, address, phone number and provider details before submitting an application.

• We do not tell your GP surgery or the partner who told you about the service what you have shared with us unless you have agreed, there is a safeguarding reason, or another lawful basis applies.

Paper forms include clear consent wording and are signed or otherwise confirmed by you. They are stored securely before being entered into our systems and are then either securely kept for the retention period in section 11 or securely destroyed.

 

7. Consent and withdrawing consent

Where we rely on consent, it will be freely given, specific, informed and unambiguous, and explicit where special category information is involved. We will not pressure you into giving consent, and our consent wording is kept separate from our general terms. We record the date, the method and what you agreed to.

You can withdraw your consent at any time, and it should be as easy to withdraw as it was to give. To do so, contact us by helpline, email or post using the details in section 15. We will act on your request promptly, although we may need to keep limited records where there is another lawful reason to do so.

Withdrawing consent does not affect anything we did lawfully before you withdrew it. If we have already passed your information to a provider, that provider holds it under its own privacy policy, and you may need to contact them as well.

 

8. Information relating to children and vulnerable people

Some of our work involves children, young people and families, including people who may be vulnerable.

Where we collect or use personal information relating to children or vulnerable individuals, we take appropriate care to ensure that information is handled fairly, securely and only for appropriate purposes.

Where appropriate, we may provide additional information or obtain permissions through parents, guardians, schools, partner organisations or other appropriate representatives.

We will not ask children to provide unnecessary personal information through our website.

9. Sharing personal information

We do not sell personal information. We only share information where there is a clear purpose, a lawful basis and appropriate safeguards, and we limit what we share to what is necessary. We may share it with:

• PSR and essential service providers: only the information needed to complete your application.

• GP surgeries and referral partners: we do not disclose information back to them unless you have agreed, there is a safeguarding reason, or another lawful basis applies.

• Safeguarding bodies and emergency services: where necessary to protect someone from serious harm or to meet legal obligations.

• Funders and reporting bodies: we use anonymised or aggregated information wherever possible. We will only share information that identifies you where this is necessary for project administration, monitoring or evaluation and there is a lawful basis to do so.

• Schools, colleges, universities, local authorities, public-sector bodies and other project partners: where this is necessary to deliver a particular project or programme.

• Suppliers and service providers: professional advisers and website, hosting, IT, cloud storage, email, security, communication and secure-destruction providers who process information on our behalf. We put appropriate contracts and security arrangements in place with them.

• Law enforcement, regulators and other authorities: where we are legally required to do so.

10. Transfers outside the UK

We do not transfer personal information outside the UK unless appropriate safeguards are in place. This includes the use of cloud services or software providers that store or access information overseas. We review any proposed transfer before it begins.

11. How long we keep information

We only keep personal information for as long as it is reasonably necessary for the purpose for which it was collected, or for as long as we are required to keep it by law. We review the information we hold regularly and securely delete, anonymise or destroy it at the end of the retention period. Our usual retention periods are:

Type of record	How long we usually keep it
PSR support case records	6 years from case closure, unless a shorter period is adopted
Consent records	For as long as the related case record is kept
Helpline notes	12 months where no support case is opened. Where a case is opened, notes are kept with the case record.
Complaint records	6 years from closure
Safeguarding records	In line with our safeguarding policy and legal or professional advice, which may mean a longer period
Staff and volunteer records	6 years after the end of the role, unless the law requires otherwise
Anonymised monitoring data	May be kept for longer, as individuals cannot be identified from it. It is used for impact reporting and funding evidence.

 

12. Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These include:

• secure systems with individual user accounts, strong passwords and multi-factor authentication where available;

• limiting access to the people who need the information for their role, with no shared logins;

• locked storage for paper forms, and no unattended paper forms, case notes or devices in public areas;

• secure transfer methods, avoiding unnecessary email attachments, and password protection or encryption for sensitive documents where appropriate;

• updated devices and malware protection;

• confidential shredding or secure destruction of paper records; and

• guidance for our staff and volunteers on handling personal information, and prompt reporting and investigation of any suspected data breach.

If a breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, and we will report it to the Information Commissioner’s Office (ICO) where required. However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

13. Marketing and communications

We do not use information collected for PSR support for unrelated marketing, fundraising or promotional communications unless you have been clearly told and we have a lawful basis to do so. Where electronic marketing is involved, we also comply with the Privacy and Electronic Communications Regulations (PECR).

14. Third-party websites and services

Our website may contain links to websites or services operated by other organisations. Examples may include partner organisations, public services, funders, community organisations and service providers.

Once you leave our website, the privacy practices of that organisation will apply. We recommend checking the privacy information provided by any third-party website before submitting personal information.

15. Your data protection rights

Under UK data protection law, you may have the following rights:

• the right to be informed about how your personal information is used;

• the right of access to the personal information we hold about you;

• the right to ask us to correct inaccurate or incomplete information;

• the right to ask us to delete personal information in certain circumstances;

• the right to ask us to restrict how we use your information in certain circumstances;

• the right to data portability in certain circumstances;

• the right to object to certain types of processing;

• rights relating to automated decision-making and profiling; and

• the right to withdraw your consent at any time, where we rely on consent.

These rights are subject to certain legal exceptions and may not apply in every situation. If you make a request, we will normally respond within one calendar month. To exercise a right, please contact us:

The Social Brokers NW CIC

Top Floor

26 Hope Street

Liverpool

L1 9BX

Email: connect@thesocialbrokers.com

Telephone: 0151 440 2400

16. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so that we have an opportunity to address your concern, using the details in section 15.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection.

Information about making a complaint is available from the ICO at https://ico.org.uk/make-a-complaint/

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our activities, services, technology or legal requirements, and we review it at least annually.

The latest version will always be published on this website with the date it was last updated.