1. About Us & Data Controller Details
VICO Care & Wellbeing Ltd ("VICO", "we", "our", or "us") is a specialist care and supported living provider incorporated in England and Wales (Company Registration No: 17277153). We operate residential, supported living, and therapeutic services across Gloucestershire and the West Midlands.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, VICO Care & Wellbeing Ltd acts as the Data Controller for personal data collected through our website, placement referral portal, job applications, and day-to-day care operations.
Registered Office: 58 Northgate Street, Gloucester, GL1 1SQ, United Kingdom.
Data Protection & Governance Contact: Admin@vicocaregroup.co.uk
2. Personal Data We Collect
We may collect, store, and process various categories of personal information:
- Placement Referrers & Local Authorities: Name, role/title, local authority or agency name, work telephone, verified email address, and authenticated portal login credentials.
- Young People & Care Recipients: Initials, age, gender, placement history, communication needs, dietary requirements, and specific behavioral support profiles.
- Job Applicants & Staff: Full name, contact details, residential address, CV and employment history, Right to Work in the UK documentation, driving license status, and online DBS check records (uCheck).
- Website Visitors & Inquirers: Name, email address, feedback text, newsletter subscription preferences, IP addresses, browser user agent, and communication logs.
3. Special Category & Sensitive Health Data
As a regulated care provider, we process Special Category Data concerning health, disability, therapeutic assessments, and background checks. This is processed under strict governance according to:
4. Lawful Bases for Processing (Article 6 UK GDPR)
| Processing Activity | Lawful Basis |
|---|---|
| Care Placement Intake & Assessment | Vital Interests (Art 6(1)(d)) & Legal Obligation (Art 6(1)(c)) under CQC Regulations. |
| Recruitment & Staff Pre-Employment Checks | Contractual Steps (Art 6(1)(b)) & Legal Obligation (Art 6(1)(c)) for DBS vetting. |
| Referrer Portal Accounts & Audit Logs | Legitimate Interests (Art 6(1)(f)) & CQC Regulation 17 Good Governance compliance. |
| Newsletter & Updates | Explicit Consent (Art 6(1)(a)) — revocable at any time. |
5. How We Use Personal Information
- To assess, facilitate, and manage specialist supported living and residential placements.
- To schedule interviews, perform online Teams meetings, and coordinate recruitment workflows.
- To maintain immutable security audit logs to protect vulnerable individuals' placement records.
- To respond to inquiries, feedback, and referrals submitted through our digital channels.
- To comply with Care Quality Commission (CQC), Local Authority, and statutory inspection mandates.
6. Third-Party Disclosures & Infrastructure
We do not sell personal information. We share data only with verified partners under strict data processing agreements:
- Local Authorities, NHS Trusts & Social Services: For coordinated care and placement funding.
- Regulatory Bodies: Care Quality Commission (CQC), Ofsted, and local safeguarding boards.
- uCheck (DBS Checking Partner): For statutory pre-employment criminal record verification.
- Microsoft 365 / Entra ID: Secure email, identity access management, and Teams meeting coordination.
- Google Cloud: ISO 27001 / SOC 2 certified database, hosting, and cloud storage infrastructure with encryption at rest and in transit.
7. Data Retention & Storage Security
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to meet statutory CQC, NHS, and safeguarding requirements:
- Care & Placement Records: Retained for a minimum of 8 years for adults, or up to the 26th birthday for young people, and 75 years for statutory child protection cases.
- Job Applications: Retained for up to 6 months post-decision (unless candidate requests inclusion in talent pool).
- Security Audit Trails: Retained for 7 years to satisfy regulatory compliance.
8. Your Rights Under UK GDPR
You have statutory rights regarding your personal data:
- Right of Access (SAR): Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete information.
- Right to Erasure: Request deletion of your data (subject to legal care record retention exemptions).
- Right to Restriction: Request restriction of processing under certain circumstances.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent for newsletters and optional communications at any time.
To exercise any of these rights, contact our Data Protection & Governance team at Admin@vicocaregroup.co.uk. We respond within one calendar month.
9. Cookies & Technical Security Data
We use essential security and session cookies strictly necessary to maintain secure authenticated logins, prevent Cross-Site Request Forgery (CSRF), and protect sensitive placement records under CQC Regulation 17. We do not use third-party advertising or tracking cookies.
10. Contacting Us & Filing a Complaint
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact our team:
Data Protection & Governance Lead: VICO Care & Wellbeing Ltd
Email: Admin@vicocaregroup.co.uk
Telephone: 07741 025696
Address: 58 Northgate Street, Gloucester, GL1 1SQ
You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO):
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk | Helpline: 0303 123 1113