Privacy Notice

Please note, if you would like to discuss this Privacy Notice in person or would like it made available in a different format, please contact us on 0115 9209524 or email [email protected] 

Nottingham mencap is a Nottingham based charity for adults and children with learning disabilities and autism.

We collect, store and process certain personal information about our clients, their carers, our staff and our volunteers. We are therefore registered as a data controller with the Information Commissioners Office. Nottingham mencap is A Company Limited by Guarantee Ref number 2474506 and Charity Commissioners Registration number 1046081.

We respect your right to privacy. This privacy notice explains what information we record, why we do this, what we do with the information and how we keep it safe in accordance with the General Data Protection Regulation (GDPR). It also explains your rights and how you can help us to make sure your information is kept up to date and accurate. 

In this Privacy Notice all references to “we” or “us” or “our” relate to Nottingham mencap, a company incorporated in England and Wales (Limited by Guarantee Ref number 2474506), whose registered office is Harpenden House, 203 Edwards Lane, Sherwood, Nottingham. NG5 3JA. 

Nottingham mencap is the controller of any personal information processed as set out in this Privacy Notice. 

In this document we will explain the following: 

  • What information we collect
  • Our legal basis for collecting the information
  • Why we collect the information and how we use it
  • How we store the information
  • Who we might share your information with and why
  • How long we will keep your information
  • Your rights
  • How to make sure your information is accurate

What information do we collect?

We collect information on our clients, staff, volunteers, general enquirers, job applicants and visitors to our website. We might also collect information on relatives or carers of clients, staff and volunteers so that we can contact them in an emergency. 

We hold basic information about you such as your name, address, telephone number, email address, date of birth, gender, next of kin and GP. We may also hold more sensitive information such as: 

  • Medical and health details
  • Disability details
  • Client Care Plans
  • Relevant information from health and social care professionals
  • Education details
  • Ethnicity – to help plan activities and ensure equal access
  • Safeguarding reports
  • Incident reports
  • Protection Plans

We also store photographs of clients to enable identification for safeguarding purposes. Any other images and videos will only be held and used with prior consent. 

What is our legal basis for collecting this information? 

The legal basis for us collecting and processing your information is that: 

It is necessary to fulfil the contract between you and us or the steps you and/or your carer/representative have asked us to take towards entering into a contract

It is necessary to meet legislation and contractual obligations arising from placements commissioned by Health and Social care services

Why do we collect this information and what do we do with it? 

We collect this information so that we can: 

  • Provide you with the best possible service
  • Enable you to work in partnership with us to meet your individual needs
  • Ensure the safety of everyone who uses and has contact with our service
  • Work effectively with others providing you with support and care
  • Contact and communicate with you regarding our service activities
  • Update you on service developments
  • Discuss and investigate any issues, concerns, complaints or legal claims
  • Review the service we are providing
  • Process financial transactions such as client fees and staff salaries
  • We may keep a record of any communications we have with you such as emails or telephone calls. 

How do we store the information?

We hold your records securely in both paper and electronic format. 

We have a duty to: 

  • Keep and maintain accurate and up to date records of the support we provide to our service users
  • Keep and maintain accurate and up to date staff records
  • Keep your information confidential and secure

We, or third parties acting on our behalf, may also store or process information that we collect about you in countries outside the European Economic Area, which may have lower standards of data protection. Specifically, servers used by our website are located in the United States and some of our third party service providers operate around the world. We have technical and organisational security measures in place to prevent the loss or unauthorised access of your personal information, however, please be aware that we cannot guarantee the security of information transmitted over the Internet. 

Who might we share your information with and why?

We will share your information with third party organisations who are contracted to provide services to Nottingham mencap. This will only be the case in order to meet our contractual obligations to you, to meet statutory requirements or to support the care needs of our clients such as: 

  • Local authorities and NHS – health and social care professionals
  • Supply Staff Agencies – to enable their staff to support you safely and effectively
  • IT provider responsible for maintaining IT systems and security
  • Accountants – in order to process payroll
  • Workplace Pension provider – staff pension scheme
  • Website provider
  • Insurance companies

We may also share your information where we believe there is a legal or regulatory reason for us to do so such as: 

  • To report safeguarding concerns or incidents
  • To respond to any legal claims
  • To comply with any relevant law or legal process

We will not sell your information to other organisations or share your personal information with other organisations for the purposes of marketing or fundraising.

Our website provider

Your data may be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behavior of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply:

  • Your data will be made available to our website provider
  • The data that may be available to them include any of the data we collect as described in this policy.
  • Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA.
  • They will store your data for a maximum of 7 years.
  • This processing does not affect your rights as detailed in this privacy policy. 

How long we will keep your information?

We will keep your records for no longer than is reasonably necessary and in line with our records retention policy as follows: 

  • Client records – 3 years from date service ended
  • Client records where no contract is entered into – 6 months from date of enquiry or referral
  • Employee pension details – 7 years post-employment
  • Employee records – 6 years post-employment
  • Recruitment (successful applicants) – 6 years post-employment
  • Recruitment (unsuccessful applicants) – 6 months post recruitment campaign
  • Finance records – 7 years 

Your rights

You have the right: 

  • To be informed
  • To access your information
  • To have inaccurate or incomplete information corrected
  • To erasure – to have your information removed or deleted
  • To restrict the processing of your information
  • To data portability – to obtain and move your personal information
  • To complain

Your right to be informed

You have the right to be informed about the information we keep and how we use it. That is why we have written this privacy notice. We may need to make changes to our Privacy Notice from time to time but the most up to date version will always be available on our website If we make any major changes to it we will post a notice on our website or let you know in writing. 

Your right to access your information

You have the right to confirm we are processing your personal information and to access your personal information. You can do so by contacting us:

Administration Team

Harpenden House

203 Edwards Lane




Tel: 0115 9209524 

Requests for access to information will be responded to as soon as is reasonably possible and no later than within one month in line with the GDPR. 

Your right to have inaccurate or incomplete information corrected

If you think the personal information we have for you is not correct, you can contact us to ask that we put right any inaccurate or incomplete data. We will respond within one month. 

Your right to erasure

You have the right to ask us to erase, or delete, your personal information or to restrict the processing of your data. Each request will be considered on an individual basis and in line with the GDPR. If we agree to your request to erase or delete your personal information, we will no longer be able to fulfil our contract with you. 

Your right to restrict processing

You have the right to ask us to stop processing your information. Each request will be considered on an individual basis and in line with the GDPR. If your request is upheld we would continue to store your information but would not do anything with it. This restriction in processing your information could be temporary or permanent depending on the request. 

Your right to data portability

This means you have the right to ask us to send you the information you have given to us so that you can pass it on to other organisations so that they can use the information. You may ask us to send the information straight to another organisation. If your personal information also contains information about other people we will need to consider whether sending the information would affect their rights. We will respond to all requests as soon as possible and within no more than one month, unless the request is complex, in line with the GDPR. 

Your right to complain

If you are not happy with the way in which we are handling your personal information you can contact us at the address above or telephone 0115 9209524. 

If you are not satisfied with the way we have dealt with your complaint you can contact the Information Commissioner’s Office (ICO):

Wycliffe House

Water Lane


Cheshire, SK9 5AF


Helpline: 0303 123 1113 

How you can help us to make sure your information is accurate

It’s important that you let us know if any of your personal details change, for example if you change address, telephone number, email address, GP etc. In order to keep accurate records we need to know of any changes. We will then inform anyone with whom we have shared your information so they can update their records. 

This privacy notice was last updated on 26th March 2019 

Some of the information contained within this document was obtained from the Information Commissioner’s Office Guide to the General Data Protection Regulation (GDPR) web pages 

This document contains public sector information licensed under the Open Government Licence v3.0