Kent and Medway Privacy Notice
Kent & Medway IPS is a partnership between Shaw Trust and NHS Kent and Medway ICB. This Privacy Policy explains how we collect, use, and protect your personal data when you engage with our services or visit our website.
1. Who we are
Kent & Medway IPS is commissioned by NHS Kent and Medway ICB and delivered by Shaw Trust. Shaw Trust act as Data Processor for the purposes of data protection legislation.
Contact Details
Shaw Trust – Data Protection Officer
Black Country House, Rounds Green Road, Oldbury B69 2DG
Email: data.protectionmailbox@shaw-trust.org.uk
What personal data we collect
We may collect the following types of personal information:
- Participants: name, email address, telephone number, home address, postcode, date of birth
- Referrers: name, email address, telephone number, home address, postcode
- Referral Data: Information relating to who made the referral and their contact details (referrer name, email, phone number, address, postcode)
How we collect your data
We collect your data in the following ways:
- Directly from you – via forms, phone calls, web enquiries or in-person support
- From partner organisations – including GPs, NHS services, councils or referral agencies
- Through our website – using cookies and usage analytics
- From public sources – e.g. when fulfilling safeguarding obligations
Why we use your data
We use your data to:
- Assess your needs and provide appropriate support
- Contact you regarding appointments or services
- Refer you (with your consent) to trusted support providers
- Monitor service quality and contract performance
- Comply with legal or safeguarding obligations
- Improve our services through anonymous analysis
Lawful basis for processing
We rely on one or more of the following UK GDPR bases:
- Consent – for marketing or voluntary services
- Public task – to deliver commissioned public services
- Contract – to deliver services you have signed up to
- Legitimate interest – to improve our services and site performance
- Legal obligation – e.g. safeguarding or regulatory reporting
- Substantial public interest – where we process special category data for health or equality monitoring
Who we share your data with
We may share your information with:
- NHS Kent and Medway ICB (service funders)
- Local partners delivering support
- Referral agencies
- IT or CRM system providers (under contract)
- Regulators, safeguarding bodies, or legal authorities where required
We do not sell or rent your data to third parties.
How long we keep your data
We retain your data only for as long as needed:
- Enrolled participants – personal data will be retained for up to 6 years following the end of their engagement
- Referral records – in line with our safeguarding and contractual obligations
- Cookies and website data – see Cookie Policy
After this, your data is securely deleted or anonymised.
How we protect your data
We take data security seriously. Measures include:
- Encrypted storage and secure servers
- Role-based access controls
- Staff training and policy compliance
- Data Protection Impact Assessments (DPIAs) for new systems or processes
- Contracts and vetting for all third-party suppliers
International transfers
Your data is primarily stored in the UK. If we use suppliers who process data outside the UK/EEA, we ensure appropriate safeguards (such as Standard Contractual Clauses or UK Addendum).
Your data protection rights
You have the right to:
- Access your personal data
- Correct inaccuracies
- Request deletion (in some cases)
- Restrict or object to certain processing
- Withdraw consent at any time (where consent is used)
- Request data portability
- Lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise your rights, email: data.protectionmailbox@shaw-trust.org.uk
To complain to the ICO: www.ico.org.uk