Carers’ Resource Privacy Notice

Date last updated: 13 August 2026

Who this privacy notice applies to

This privacy notice explains how Carers’ Resource collects, uses, stores and shares personal information relating to:

carers who contact us, are referred to us or receive support from us;
people who are cared for, where information about them is relevant to the support we provide;
children and young people who are registered with us, or referred to us, as Young Carers;
parents and guardians of children and young people who use our Young Carers service, where relevant;
professionals, including school staff, health and social care professionals and representatives of other agencies, who contact us, refer someone to us or work with us to provide support; and
employees and volunteers, including where Disclosure and Barring Service checks are required.

Information about a cared-for person may be provided by the carer, the cared-for person themselves or an appropriate professional or agency.

We do not routinely collect personal information about children or cared-for people who are not involved with our services. Where information about someone is received incidentally, for example because they are mentioned within an enquiry, we will only use it where necessary and in accordance with data-protection and safeguarding requirements.

Employees and volunteers may also be given additional privacy information that relates specifically to recruitment, employment or volunteering.

Who we are

Carers’ Resource is the data controller for personal information that we collect and use for our own purposes.

Name: Carers’ Resource
Registered charity number: 1049278
Company registered in England number: 03054273
Registered office: Unit 3, Grove Park Court, Grove Park Terrace, Harrogate, HG1 4DP
Telephone: 0808 50 15 939
Email: info@carersresource.org

Organisations with which we share information may be separate data controllers for their subsequent use of that information. The responsibilities of each organisation are set out in the relevant agreements and data-protection arrangements.

The personal information we collect

Depending on your relationship with us and the support or service being provided, we may collect and process:

your name, title and date of birth;
your address, postcode, email address and telephone number;
emergency contact details;
demographic and equality information, such as age, gender, ethnicity, religion, sexual orientation and disability information;
information about caring, family and household relationships;
information about the person being cared for, where it is relevant to the support being provided;
referral information;
records of enquiries, communications and appointments;
assessments, case notes, support plans and outcomes;
information about services, groups or events you have attended;
feedback, complaints and survey responses;
financial and banking information where this is needed to administer a grant or payment;
professional information, such as job title, employer and professional contact details;
employee and volunteer information;
health, care and safeguarding information relevant to the support we provide;
criminal conviction and offence information, including information obtained through DBS checks where applicable; and
any other personal information that is reasonably necessary to provide support, administer our services or meet our legal responsibilities.

Some of this information may be special category personal data, which receives additional protection under data-protection law. This includes information about:

health;
racial or ethnic origin;
religious or philosophical beliefs;
sexual orientation;
sex life;
genetic or biometric information used for identification; or
trade-union membership.

How we obtain personal information

Most of the personal information we process is provided directly by you, for example when:

you contact us for information, advice or support;
you complete one of our forms;
you attend an appointment, group or event;
you apply for a grant;
you provide feedback or make a complaint;
you apply to work or volunteer with us; or
you communicate with a member of our staff.

We may also receive personal information from another person or organisation, including when:

a professional or agency makes a referral on your behalf;
a carer provides relevant information about the person they care for;
a cared-for person provides information about their circumstances;
a parent or guardian refers a child or young person for Young Carers support;
a school, health professional, social care professional or other agency makes a Young Carers referral;
a local authority or other partner organisation provides information to coordinate support or address a safeguarding concern; or
an employer, referee or DBS service provides information relating to employment or volunteering.

Where reasonably possible, people making a referral should tell the person concerned that their information is being provided to us and direct them to this privacy notice.

Why we use personal information

We may use personal information to:

respond to enquiries and referrals;
assess a person’s circumstances and support needs;
provide information, advice, practical assistance and other services;
provide Young Carers support;
coordinate support with relevant professionals and partner organisations;
protect the safety and wellbeing of children, adults at risk, staff, volunteers and other people;
administer grants, payments and financial support;
maintain accurate records of the support we provide;
monitor service quality, performance and outcomes;
meet contractual, financial, regulatory and legal requirements;
provide reports to funders and commissioners;
improve and develop our services;
investigate complaints, incidents and safeguarding concerns;
contact people for feedback, consultations or research where appropriate;
provide information about relevant services, groups or events where permitted; and
manage employees, volunteers and recruitment.

Reports to funders and commissioners will normally use aggregated or non-identifying information wherever possible. We will only provide identifiable information where this is necessary, lawful and proportionate.

Where we send promotional or marketing communications, we will obtain consent where required. You can ask us to stop sending these communications at any time.

For information about website cookies and analytics, please refer to our separate website privacy and cookie information.

Who we share personal information with

Where necessary and lawful, we may share personal information with:

local authorities and other statutory organisations;
health and social care professionals;
schools, colleges and other education providers;
organisations working with us to provide support;
safeguarding partners;
funders and commissioners;
service providers that process information on our behalf, such as secure IT, database, communications and payment providers;
professional advisers, auditors and insurers;
regulators and public authorities;
the police, emergency services or courts; and
other organisations where disclosure is required or permitted by law.

We only share information that is relevant, necessary and proportionate for the purpose concerned.

Where another organisation processes information on our behalf, we require appropriate contractual, confidentiality and security arrangements.

Sharing information about Young Carers

Bradford Children and Families Trust

Where necessary to safeguard or support a young carer, promote their welfare or coordinate services, we may share relevant information with Bradford Children and Families Trust, commonly referred to as BCFT.

This may include:

the young person’s name;
address or postcode;
date of birth;
gender;
Young Carer support-level status; and
where the young person is open to BCFT, relevant Young Carer assessment information.

We will only share information that is necessary and proportionate for safeguarding, welfare or coordinated service provision.

Our lawful basis for this sharing is recognised legitimate interest under Article 6(1)(ea) of the UK GDPR, relying on the safeguarding of vulnerable individuals condition in UK GDPR Annex 1, paragraph 6.

Where the information includes special category personal data, we also rely on:

Article 9(2)(g) of the UK GDPR – processing that is necessary for reasons of substantial public interest; and
Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018 – safeguarding children and individuals at risk.

We maintain an appropriate policy document where this is required by law.

North Yorkshire Council

From July 2026, we routinely share limited information about young carers using, or referred to, our Young Carers service in North Yorkshire with North Yorkshire Council’s Children and Families Service.

This sharing helps Carers’ Resource and North Yorkshire Council to:

identify young carers;
coordinate appropriate support;
avoid services working in isolation or unnecessarily duplicating work; and
protect and promote the physical, mental and emotional wellbeing of young carers.

The information shared is strictly limited to:

the young person’s name;
date of birth; and
postcode.

As part of this routine arrangement, we do not share:

Young Carer assessments;
case notes or case records;
support-level information;
health or care information; or
details about the person being cared for.

The sharing is limited to what is necessary and proportionate for identifying and supporting young carers. Information is transferred securely, accessed only by authorised staff and processed in accordance with an approved Data Protection Impact Assessment and the relevant data-sharing arrangements.

North Yorkshire Council is responsible for ensuring that its subsequent use of the information complies with its own data-protection responsibilities.

Other safeguarding information sharing

Outside the routine arrangements described above, we may share relevant personal information with a local authority, the police, health services, education providers or another safeguarding organisation where this is necessary to:

protect a child or adult at risk from harm, abuse or neglect;
respond to an immediate risk to someone’s life, health or wellbeing;
investigate or manage a safeguarding concern;
comply with a legal obligation; or
support another organisation that has statutory safeguarding responsibilities.

We will consider each situation individually and share only the information that is necessary and proportionate.

Data-protection consent is not always required for safeguarding information sharing. Where consent is not appropriate or cannot be obtained, we will only share information where another lawful basis applies.

Our lawful bases for using personal information

Under the UK GDPR, we must have a lawful basis for each way in which we use personal information. Depending on the circumstances, we may rely on the following bases.

Consent – Article 6(1)(a)

We may rely on consent where you have been given a genuine choice and have provided clear agreement to an optional activity, such as certain marketing communications, research or feedback activities.

You may withdraw your consent at any time. Withdrawing consent will not affect processing that took place before consent was withdrawn.

Contract – Article 6(1)(b)

We may rely on contract where processing is necessary to enter into or perform a contract directly with you, such as certain employment or service arrangements.

Legal obligation – Article 6(1)(c)

We may process information where this is necessary to comply with a legal obligation, including certain employment, financial, regulatory, safeguarding and record-keeping requirements.

Vital interests – Article 6(1)(d)

We may process or share information where this is necessary to protect someone’s life or respond to a serious and immediate risk.

Recognised legitimate interest – Article 6(1)(ea)

We may rely on recognised legitimate interest where processing is necessary for one of the public-interest purposes specifically recognised in UK data-protection law.

This includes processing that is necessary to safeguard a vulnerable individual, including protecting a child’s physical, mental or emotional wellbeing or protecting them from harm or neglect.

Legitimate interests – Article 6(1)(f)

We may rely on legitimate interests where processing is necessary for the legitimate interests of Carers’ Resource, the people we support or another organisation, and those interests are not overridden by the person’s rights and freedoms.

These interests may include:

providing and improving support services;
maintaining accurate service records;
managing and administering our organisation;
monitoring service quality and outcomes;
maintaining the security of our systems;
proportionate reporting to funders and commissioners; and
providing relevant service information where people would reasonably expect this.

Where we rely on legitimate interests, we assess the purpose, necessity and potential effect on the person concerned. We take particular care where children’s information is involved.

Special category personal data

Where we process special category personal data, we must have both an Article 6 lawful basis and an additional condition under Article 9 of the UK GDPR.

Depending on the circumstances, we may rely on:

Article 9(2)(a) – explicit consent, where explicit consent is appropriate and freely given;
Article 9(2)(b) – employment, social security and social protection law, where relevant to employees, volunteers or support relating to social protection;
Article 9(2)(g) – substantial public interest, including safeguarding children and individuals at risk, counselling and support for people with a disability or medical condition, where the relevant conditions in Schedule 1 of the Data Protection Act 2018 are met; and
Article 9(2)(h) – health or social care, where the processing is necessary for the provision or management of health or social care and the relevant legal and confidentiality requirements are satisfied.

Where required, we maintain an appropriate policy document explaining how we comply with the data-protection principles and how this information is retained and deleted.

Criminal conviction and offence information

Where we process criminal conviction or offence information, including information obtained through DBS checks, we do so only where permitted by law.

We process this information in accordance with Article 10 of the UK GDPR, the Data Protection Act 2018 and any applicable safeguarding, employment or regulatory requirements.

Access to this information is restricted to authorised staff and it is subject to additional safeguards.

How we keep personal information secure

We use appropriate technical and organisational measures to protect personal information against:

unauthorised access;
accidental loss;
inappropriate disclosure;
alteration;
misuse; and
destruction.

These measures include, where appropriate:

access controls;
secure systems and transfer methods;
staff and volunteer training;
confidentiality requirements;
contractual safeguards for service providers;
secure storage;
regular review of access permissions; and
procedures for managing and reporting data-security incidents.

Access to personal information is limited to people who need it for their work.

How long we keep personal information

We only keep personal information for as long as it is needed for the purpose for which it was collected, or for as long as we are legally required to retain it.

Our standard service-user retention periods are:

adult service-user records: normally seven years after the relevant support record is closed; and
Young Carer records: normally until the young person’s 25th birthday.

Different retention periods may apply to:

employment and volunteer records;
DBS information;
safeguarding records;
complaints and incidents;
grant and financial records;
insurance or legal claims; and
records that must be retained under a funding agreement or legal requirement.

These records are retained in accordance with our retention schedule and applicable legal requirements.

At the end of the relevant retention period, information will be securely deleted, destroyed or anonymised unless there is a lawful reason to keep it for longer.

Your data-protection rights

Depending on the circumstances and the lawful basis we rely on, you may have the following rights.

Right of access

You can ask us to confirm whether we hold personal information about you and request a copy of that information.

Right to rectification

You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

Right to erasure

You can ask us to delete your personal information in certain circumstances. This right does not apply where we are legally required to keep the information or have another lawful reason to retain it.

Right to restriction

You can ask us to restrict how we use your personal information in certain circumstances.

Right to data portability

In certain circumstances, you can ask us to provide personal information that you supplied to us in a structured, commonly used and machine-readable format, or transfer it to another organisation.

Right to withdraw consent

Where we rely on consent, you may withdraw that consent at any time.

Right to object

You have the right to object where we rely on recognised legitimate interest or legitimate interests.

We will consider your objection and stop the processing unless we can demonstrate compelling legitimate grounds to continue, or the information is required for legal claims.

You have an absolute right to object to your personal information being used for direct marketing.

Exercising your rights

There is normally no charge for exercising your data-protection rights.

You can make a request by:

Email: info@carersresource.org

Post:
Carers’ Resource
Unit 3, Grove Park Court
Grove Park Terrace
Harrogate
HG1 4DP

We may need to ask for information to confirm your identity or clarify your request.

We will respond without undue delay and normally within one month. Where a request is complex or you have made several requests, we may extend the response period by up to a further two months. If an extension is necessary, we will tell you within the first month and explain why.

Not every right applies in every situation. If we cannot comply with all or part of your request, we will explain the reason, unless the law prevents us from doing so.

How to complain

If you are concerned about how we have collected, used, stored or shared your personal information, you can make a data-protection complaint to us.

You can contact us by:

Email: info@carersresource.org

Telephone: 0808 50 15 939

Post:
Carers’ Resource
Unit 3, Grove Park Court
Grove Park Terrace
Harrogate
HG1 4DP

We will:

acknowledge your complaint within 30 days;
take appropriate steps to investigate it;
keep you informed where necessary; and
tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office if you are unhappy with how we have used your information or how we have handled your complaint.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: https://ico.org.uk