Fair Processing Policy
Care Check Statement of Fair Processing
By accessing this website and providing Care Check with your personal details, you agree to accept and be bound by the terms of this statement of fair processing which is summarised below.
Using the IT specification supplied by the Disclosure and Barring Service (DBS), Security Watchdog has produced an online disclosure system, eBulkPlus, which is an alternative to the standard paper forms, therefore allowing you to complete your application at any location with internet access.
Our online service is committed to protecting the privacy of our users. When you supply any personal information to this site we have legal obligations towards you in the way we deal with your data as follows:
- We will hold your personal information on our systems for as long as needed to meet the service you have requested, and remove it in the event that the purpose has been met.
- We will ensure that all personal information supplied is held securely, in accordance with the UK Data Protection Legislation and the European General Data Protection Regulation (GDPR).
- We will provide a safe and secure experience for users of this site.
- We will ensure that the information you submit to us remains private, and is only used for the purposes set out below.
Fair Processing Principles
- Your personal information is only processed with your knowledge.
- Only information that we actually need is collected and processed.
- Your personal information is only seen by those who need it to do their jobs.
- Personal information is retained only for as long as it is required.
- Decisions affecting you are made on the basis of reliable and up to date information.
- Your information is protected from unauthorised or accidental disclosure.
- Inaccurate or misleading data will be corrected as soon as possible.
- Procedures are in place for dealing promptly with any dispute.
All information requested is used solely for the purpose of producing a Disclosure Scotland or DBS certificate (as appropriate for your location) and is collected, stored and processed by Care Check, Disclosure Scotland and the DBS in accordance with the UK Data Protection Act Legislation and GDPR. We will treat your personal information as confidential and we will not disclose it to any third party except: (i) with your prior agreement; (ii) as necessary for providing our eBulkPlus online disclosure service to you; or (iii) as required by law.
Any organisation which uses this eBulkPlus online disclosure service is obliged to sign a service contract requiring them to:
- Abide by the UK Data Protection Legislation and GDPR
- Have a policy for secure storage, handling, use, retention and disposal of Disclosures and Disclosure Information
The Security Watchdog eBulkPlus solution is hosted within an ISO27001, Capita owned data centre and all components of the service are protected by intrusion detection and intrusion prevention devices. Completed applications are fully encrypted and securely transferred to Disclosure Scotland and DBS using the eBulkPlus Interface.
The Disclosure and Barring Service will refer the details provided on this application form to government and law enforcement bodies in accordance with any relevant legislation. The details provided to these bodies will be used for identifying possible matches to records held by them. Where such a match is established, data may be released to the DBS for inclusion on any certificate issued. The details provided on this form may be used to update the records held by the bodies specified above. The details provided on the application form may be used to verify your identity for authentication purposes. The DBS may use any information provided by the DBS on a certificate or otherwise held by the DBS to inform any of its barring decisions made under its powers within the Safeguarding Vulnerable Groups Act 2006.
Who We Are
Care Check LTD (‘we’ or ‘us’ or ‘our’) gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection Regulation and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why and when we process your personal data.
Care Check’s registered office is at Suite 1 Basepoint, Crab Apple Way, Evesham, WR11 1GP and we are a company registered in England and Wales under company number 08076261. We are registered on the Information Commissioner’s Office Register; registration number Z330403X, and act as the data processor when processing your data. Our designated Data Protection Officer/Appointed Person is Charles Eason], who can be contacted at the above address, or by phone on 0333 777 8575
Information That We Collect
Care Check Ltd processes your personal information to meet our legal, statutory and contractual obligations and to provide you with our products and services. We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice.
The personal data that we collect from is: –
- Date of Birth
- Home Address
- Previous addresses
- Employment details
- Personal Email
- Business Email
- Home Telephone Number
- Mobile Telephone Number
- National Insurance Number
- Passport Number
- Driver’s License Number
- Previous names/Alias’
- Mother’s maiden name
We collect information in the below ways: –
Secure online forms, and occasionally via telephone or secure email when answering queries.
How We Use Your Personal Data (Legal Basis for Processing)
Care Check Ltd takes your privacy very seriously and will never disclose, share or sell your data without your consent; unless required to do so by law. We only retain your data for as long as is necessary and for the purpose(s) specified in this notice. Where you have consented to us providing you with promotional offers and marketing, you are free to withdraw this consent at any time. The purposes and reasons for processing your personal data are detailed below: –
- We collect your personal data purely for the processing of DBS Checks for employment or volunteering.
You have the right to access any personal information that Care Check Ltd processes about you and to request information about: –
- What personal data we hold about you
- The purposes of the processing
- The categories of personal data concerned
- The recipients to whom the personal data has/will be disclosed
- How long we intend to store your personal data for
- If we did not collect the data directly from you, information about the source
If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to do so as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.
You also have the right to request erasure of your personal data or to restrict processing (where applicable) in accordance with the data protection laws; as well as to object to any direct marketing from us. Where applicable, you have the right to data portability of your information and the right to be informed about any automated decision-making we may use.
If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.
Sharing and Disclosing Your Personal Information
We do not share or disclose any of your personal information without your consent, other than for the purposes specified in this notice or where there is a legal requirement. Care Check Ltd uses third-parties to provide the below services and business functions; however, all processors acting on our behalf only process your data in accordance with instructions from us and comply fully with this privacy notice, the data protection laws and any other appropriate confidentiality and security measures.
Disclosure and Barring Service
The DBS provide the processing of all levels of DBS checks, all information collected within the DBS application form is shared with them.
Disclosure Scotland provide the processing of Basic level checks for applicants living within Scotland.
We use intuit for the processing of our accounts, sending out invoices, statements and reminders. All information Intuit hold about our clients is held within the EU. The only information stored within their system is basic contact information for the purposes of sending out invoices.
Capita PLC are our system providers and they provide the IT infrastructure for sending secure DBS application information between Care Check and the DBS/Disclosure Scotland. All information that is held within this system is encrypted on transfer. IT staff within Capita only view application information at our request when diagnosing technical issues. The Capita PLC system holds the DBS information, plus the information relating to our registered clients e.g Employers/Charities etc. All information is held within the EU.
We use Campaign Monitor to send out bulk mailers relating to system updates, legislation changes ID rules, and system downtime. The only information held within Campaign Monitors system is registered clients email addresses. All info is held within the EU.
We use Sage Pay for the processing of credit/debit cards information. We have a separate policy for this supplier that can be found within our guidance pages.
We use Call Credit for the processing of Route 2 ID external ID validations. The only information share with Call Credit is applicants title, name and postal code. This data is held within the EU.
Care Check Ltd takes your privacy seriously and takes every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place, including: –
measures such as SSL, TLS, encryptions, pseudonymisation, restricted access, IT authentication, firewalls, anti-virus/malware
Consequences of Not Providing Your Data
You are not obligated to provide your personal information to Care Check Ltd, however, as this information is required for us to provide you with our services we will not be able to offer all our services without it.
How Long We Keep Your Data
Care Check Ltd only ever retains personal information for as long as is necessary and we have strict review and retention policies in place to meet these obligations. We are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed. DBS information is archived within our system after 6 months and completely removed after 6 years.
Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.
Special Categories Data
Owing to the products, services or treatments that we offer, Care Check Ltd sometimes needs to process sensitive personal information (known as special category data) about you, to provide employers/volunteering organisations with a result. Where we collect such information, we will only request and process the minimum necessary for the specified purpose and identify a compliant legal basis for doing so.
LEGITMIATE INTERESTS EXAMPLE
Care Check Ltd will occasionally send you service updates, promotion and guidance by email that have been identified as being beneficial to our customers and in our interests. Such information will be relevant to you as a customer and is non-intrusive and you will always have the option to opt-out/unsubscribe at any time.
Lodging A Complaint
Care Check Ltd only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the supervisory authority.
Cancellation must be made by calling us on 0333 777 8575 between 9am and 5pm Monday to Friday. We reserve the right to process and and charge in full for any disclosures unless we have received notice of cancellation before submission to DBS (formerly known as CRB) or DS. Any payments you have made for disclosures that have been properly cancelled will be re-credited to you.
Despite the above provision, you are entitled to cancel a payment for products where fraudulent use has been made of your payment card by a person not acting, or to be treated as acting as your agent. If you have already made a payment where your payment card has been so fraudulently used, then you should approach your card issuer for re credit to your account.
We reserve the right to terminate or restrict the use of our service, for any or no reason whatsoever. If we terminate your use of our service as a result of a breach of any obligation under these terms, such termination would be immediate and without notice.
Terms Of Service
Care Check terms of service (e-Bulk Electronic Applications)
Our client organisations must adhere to the following conditions when applying for, receiving, holding and disposing of Criminal Disclosures via the e-Bulk Online application channel or Paper Route.
- The Client must nominate a designated individual(s) who will act as the clients contact point for all DBS matters and receive Disclosure information.
- The client organisation will provide details of the person(s) who will verify the identity of the applicant, and that identity validation will be done in accordance with DBS guidelines using only original documents, and ensure that all applicant details are checked in the same manner.
- The client organisation must inform Care Check immediately in writing should the person(s) checking the identity of the applicants change.
- The client organisation will observe and fully adhere to the DBS (CRB) code of practice.
- Clients using the e-Bulk system will ensure that the “Statement of Fair Processing” is made available to all applicants upon request.
- The client organisation is likely and will remain likely to genuinely ask an exempted question.
- The client organisation will make all disclosure applicants aware of the Code of Practice when recruiting and will make a copy available to all disclosure applicants upon request.
- The client organisation has a satisfactory written policy on the recruitment of ex offenders and issues a copy of the policy to all disclosure applicants at the start of the recruitment process.
- The client organisation is aware that a statement must be included on its application forms or accompanying documentation, that a disclosure will be requested in the event of an applicant being offered a position.
- The client organisation is aware that it must include a statement on its application forms, or accompanying documentation, that a criminal record will not necessarily be a bar to obtaining a position.
- The client organisation must provide a statement in all employment advertisements that Disclosure will be required in the event that a post is offered.
- The client organisation has a written policy on the secure storage, handling, retention and disposal of disclosure information.
- The client organisation will not retain disclosures or a record of the information contained within them for longer than is required for the particular purpose. This should be no longer than 6 months after the date on which the recruitment or other relevant decisions have been taken, or after the date on which any dispute about the accuracy of the disclosure information has been resolved. The period should only be exceeded in very exceptional circumstances, which justify retention for a longer period. (Disclosure information may be retained for longer than 6 months for the purpose of audit where organisations are regulated by CQC or OFSTED)
- All Disclosure certificates will be destroyed in accordance with the DBS (CRB) Code of Practice by shredding, pulping or burning.
- The client organisation will keep all Disclosure information kept securely, in accordance with the DBS (CRB) Code of practice, separate from their staff members files and within a locked storage unit that cannot be moved by less than 2 persons.
- The client organisation is aware of what additional information is, and that under no circumstances can this information be divulged to an applicant (or person who is not authorised to have access to this information) and that to do so would constitute a criminal offence.
- Additional information is very sensitive and must be treated with the utmost caution. Should the client organisation be informed of additional information then they should be careful to base their withdrawal of an offer on employment on pre employment checks, and avoid letting the applicant know that there is “additional information”
- Client organisations should discuss any matters revealed in the disclosure with the applicant before withdrawing the offer of employment.
Information provided on the disclosure is confidential, and as such should only be available to those persons named in the client contract. (Unless the person is a registered inspector with the CQC, CSCIW or OFSTED)
- Care Check reserves the right to make assurance visits to our client organisations to ensure that they are fully complying with the terms and conditions of our contract and the DBS (CRB) Code of Practice.
- Should Care Check find that any part of this contract is being breached, it reserves the right to withdraw its service with immediate effect.
- It is the client organisations responsibility to state the level of check they require and if the applicant is working with Children, Vulnerable Adults or both.
- Care Check shall have no liability for defective services where the defect has been caused or contributed by the client organisation
- Care Check shall have no liability for defective services where the defect has been caused or contributed by DBS (CRB).
- Care Check shall have no liability to the client organisation for services if invoice payments have not been received by the due dates of payment.
- Care Check have no liability for additional damage, loss, liability, claims or expenses caused or contributed to by the Client’s continued use of services or the continued engagement of an Applicant once an error or defect in the relevant Disclosure has become apparent.
- Care Check shall have no liability for any matters which are outside its reasonable control.
- Care Check shall have no liability to the client for any consequential losses, loss or profits and/or damage to goodwill, economic losses, special damages and indirect losses or business interruption, loss of business, contracts, opportunity and production.
- Invoiced Clients shall pay Care Check for all invoices within 15 days of receipt. invoices are raised and sent upon receipt of application. Invoices will be raised for the application if completed correctly or if in need of amendment.
- Clients using the e-Bulk online channel will ensure that all passwords and log on details are kept private and are under no circumstances passed on to any other person.
- Clients using the e-Bulk system will change their passwords on a regular basis, preferably every month not rotating the same password within a three month period.
- Clients using the e-Bulk system shall take reasonable care to ensure that no person is within distance to take note of log on details or disclosure information when accessing the e-Bulk system.
- ID Checkers using the e-Bulk system shall always check original ID, no photocopies at the time that the information is imputed into the e-Bulk system.
- Clients using the e-Bulk system shall keep the information held securely on it, unless it needs to be printed for the purposes of audit.
- Clients using the e-Bulk system who print disclosures for the purpose of audit shall only print them once and shall keep them in accordance with the DBS (CRB) Code of Practice and their policy on the secure storage, retention and disposal of disclosure information.
- Responsible persons using the e-Bulk system, or the responsible persons Employers shall inform Care Check immediately if they are to leave the client organisation or cease using the system so their log on details can be deleted immediately.
- ID Checkers, using the e-Bulk system, or the ID Checker employers shall inform Care Check immediately if they are to cease being employed by the client organisation or cease using the system so their log on details can be deleted immediately.
- Disclosure certificates shall not be passed on to persons not named in the service contract without the written consent of the applicant.
Care Check Delivery Policy
Care Check Delivery Policy
Deliveries can only be made to addresses within the United Kingdom (including Northern Ireland) This excludes PO Box addresses.
We currently use Royal Mail pre-paid postage to deliver your disclosures to you. Actual delivery times may vary to you depending on your delivery address or circumstances impacting delivery by Royal Mail.
We reserve the rights to use alternative delivery methods without prior notification. You will not hold us responsible for any delays outside our control, which relate to the delivery of completed disclosures.
We reserve the right to cancel your login to the online disclosure system if it becomes apparent that, in our sole opinion, the postal service in your area is too unreliable.
From small businesses to large employers and charities. We are adept at obtaining all levels of DBS Checks (Formerly the CRB) for any person within any type of industry.