HAMPSHIRE CARE ASSOCIATION

Privacy Notice

Document Title: Privacy Notice
Document Owner: Hampshire Care Association
Policy Owner: Data Protection Officer
Version: 1.0
Status: Approved
Approved By: Emma Heath
Approval Date: 12/11/2026
Effective Date: 12/11/2026
Review Date: 24 Months From Approval

Related Documents: Data Protection Policy; Privacy Notice; Data Protection & Privacy Complaints Procedure; Data Protection Impact Assessment Procedure; Records Retention Schedule; Information Sharing & Data Processing Procedure; Business Continuity Arrangements

1. About this Privacy Notice

Hampshire Care Association (HCA) respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how HCA collects, uses, stores and shares personal information when you:

  • become an HCA member;
  • communicate with HCA;
  • attend an HCA event or webinar;
  • use HCA services or resources;
  • complete an HCA form or survey;
  • interact with the HCA website;
  • communicate with us by email, telephone or other communication channels;
  • provide information for the HCA Member Directory; or
  • otherwise engage with HCA.

It also explains your rights in relation to your personal information and how you can exercise those rights.

Additional privacy information may be provided at the point we collect your personal information, where appropriate.

This privacy notice applies to personal information processed by HCA in its capacity as a data controller, unless we tell you otherwise.

2. Who We Are

Hampshire Care Association (HCA) is the organisation responsible for the processing of personal information described in this Privacy Notice.

HCA supports adult social care providers and organisations and works with members, stakeholders, partners and other organisations across the adult social care sector.

For the purposes of data protection legislation, HCA will generally act as the data controller for personal information where HCA determines why and how the information is processed.

HCA contact details:
Hampshire Care Association
132 Bournemouth Road
Chandler's Ford
Eastleigh
Hampshire
SO53 3AL

General enquiries: [email protected]

Data protection enquiries: [email protected]

Telephone: 07434 571 207

If you have questions about how HCA uses your personal information, or about this Privacy Notice, please contact us using the details above.

3. What Personal Information We Collect

The information we collect will depend on how you interact with HCA.

This may include:

Contact information

  • Name;
  • Job title or role;
  • Organisation name;
  • Work address;
  • Email address;
  • Telephone number;
  • Other contact details.

Membership information

  • Membership status;
  • Membership type;
  • Organisation details;
  • Services provided;
  • Geographical area;
  • Membership records;
  • Membership correspondence;
  • Renewal and administration information; and
  • Information relating to member services and benefits.

Event and training information

  • Event registrations;
  • Attendance;
  • Booking information;
  • Dietary requirements where relevant;
  • Accessibility requirements where relevant;
  • Questions or information submitted during events;
  • Feedback; and
  • CPD or training records where applicable.

Where we collect information about health, accessibility or dietary requirements, we will only collect and use the information necessary for the relevant purpose and will apply the additional protections required by data protection law where applicable. Some information provided when booking events or accessing HCA activities may reveal information about a person’s health or other special-category personal data. HCA will only process special-category personal data where the additional legal requirements for doing so are met. We will request only the information needed for the relevant purpose and handle it in accordance with applicable data protection requirements.

Not all dietary or accessibility information is special-category personal data. Whether additional legal conditions apply depends on the information collected and what it reveals about the individual.

Communications and preferences
We may record:

  • Correspondence with HCA;
  • Enquiries;
  • Communication preferences;
  • Marketing preferences;
  • Consent records where applicable;
  • Member Directory preferences;
  • Records of opt-outs and objections; and
  • Information about how we manage communications with you.

Website and digital information
Depending on how you use our website and digital services, we may collect:

  • IP address;
  • Device and browser information;
  • Website usage information;
  • Cookie and similar technology information; and
  • Information submitted through online forms.
  • Our use of cookies and similar technologies is explained separately through our website cookie information.

4. How We Collect Your Information

We may collect personal information:

  • Directly from you;
  • When you join or renew HCA membership;
  • When you contact HCA;
  • When you register for an event, meeting or training session;
  • When you complete an online or paper form;
  • When you subscribe to communications;
  • When you provide information for the Member Directory;
  • Through our website;
  • Through HCA's CRM and other approved systems;
  • From your organisation where appropriate;
  • From event, training or project partners where appropriate;
  • From publicly available professional or organisational information; or
  • From other sources where we have a lawful basis to do so.

HCA collects personal information directly from individuals and organisations, through membership applications, enquiries, event and training bookings, communications, and the systems we use to manage our activities.

We may also obtain information from other sources, including member organisations, professional or organisational directories, publicly available sources, and relevant partners or service providers, where this is necessary for our work.

Where we obtain personal information from a source other than the individual concerned, we will provide the privacy information required by data protection law, unless an applicable legal exception applies. Where required, this information will include the categories of personal information collected and the source from which it was obtained.

We aim to provide this information within a reasonable period and, where required by law, no later than one month after obtaining the personal information. If we use the information to contact the individual earlier, we will provide the required information at the latest when we first communicate with them, where applicable.

5. Why We Use Your Personal Information

We use personal information for different purposes depending on our relationship with you and the nature of our interaction with HCA. 

Membership administration
We may use personal information to:

  • Administer HCA membership;
  • Maintain accurate membership records;
  • Process membership applications and renewals;
  • Communicate with members about their membership;
  • Provide member services and benefits;
  • Understand member needs; and
  • Manage membership enquiries.

Events and training
We may use personal information to:

  • Process bookings;
  • Manage attendance;
  • Provide event information;
  • Communicate changes or cancellations;
  • Provide training or resources;
  • Manage accessibility or dietary requirements where relevant;
  • Obtain feedback; and
  • Maintain appropriate attendance or training records.

Providing HCA services and support
We may use personal information to:

  • Provide services and support;
  • Respond to enquiries;
  • Provide information requested by you;
  • Deliver projects and programmes;
  • Provide digital support;
  • Communicate relevant sector information; and
  • Manage relationships with members, providers and stakeholders.

Communications
We may use personal information to send information relevant to your relationship with HCA, including operational, administrative and service-related communications.

Some communications are necessary to provide a service or manage your relationship with HCA and are not direct marketing.

Direct marketing
Where permitted by law, we may use your personal information to send direct marketing about HCA services, events, resources, activities and other relevant information.

Our direct marketing will comply with applicable data protection and electronic communications requirements, including the Privacy and Electronic Communications Regulations (PECR).

Depending on the circumstances, we may communicate by:

  • email;
  • telephone;
  • SMS;
  • WhatsApp;
  • post; or
  • other appropriate communication methods.

Where consent is required, we will obtain appropriate consent.

Some business-to-business electronic marketing may not require consent under PECR, depending on the type of recipient and the circumstances. Where we process personal information relating to a named business contact, we will also ensure that we have an appropriate lawful basis under data protection law.

You have an absolute right to object to direct marketing.

If you ask us to stop sending direct marketing, we will respect your request.

We may retain limited information on a suppression or "do not contact" list where necessary to ensure that your preference is respected.

6. The HCA Member Directory

HCA is developing a Member Directory to help showcase HCA member organisations and make it easier for people to find and connect with organisations within the HCA membership.

The directory is a new service, and HCA will provide clear information about how it operates before it is launched.

Depending on the final directory design, information may include:

  • organisation name;
  • organisation type;
  • services provided;
  • geographical area;
  • website;
  • organisation contact details; and
  • other information that the member organisation has agreed can be displayed.

Where information identifies an individual, such as a named contact, HCA will consider the relevant data protection requirements separately.

Your directory preferences
HCA will ask members to confirm what information they are happy for us to display.

You will be able to update your information and preferences.

Choosing whether or not to be included in the Member Directory will be separate from your direct marketing preferences.

Agreeing to inclusion in the Member Directory does not automatically mean that you have agreed to receive direct marketing.

Similarly, providing contact information for membership administration does not automatically mean that HCA can use that information for every other purpose.

7. Our Lawful Bases for Processing

UK data protection law requires HCA to have a lawful basis for processing personal information. The lawful basis we rely on depends on the purpose for which the information is being used.

The lawful bases available under the UK General Data Protection Regulation (UK GDPR) include:

Contract: where processing is necessary to enter into or perform a contract with an individual.
Legal obligation: where processing is necessary for HCA to comply with a legal obligation.
Legitimate interests: where processing is necessary for HCA’s legitimate interests or those of a third party, provided these interests are not overridden by the individual’s rights and interests.
Consent: where an individual has freely given valid consent for a specific purpose.
Vital interests: where processing is necessary to protect someone’s life or other vital interests.
Public task: where processing is necessary for a task carried out in the public interest or under official authority, where the relevant legal requirements are met.

HCA will use only the lawful basis that applies to the specific processing activity. We will explain the relevant basis in this notice and, where we rely on legitimate interests, identify those interests.

Where HCA processes special-category personal information, such as information revealing a person’s health, an additional condition under Article 9 UK GDPR must also apply, alongside an Article 6 lawful basis. Where required, HCA will also meet the relevant conditions and safeguards under the Data Protection Act 2018.

The lawful basis and any additional condition used will depend on the particular information and purpose involved.

8. Lawful Basis by Processing Activity

The lawful basis we use depends on the particular activity.

Membership administration - Contract, where processing is necessary to provide an agreed membership service; otherwise, the appropriate alternative basis must be identified.

Membership enquiries - Legitimate interests or steps taken at the individual’s request before entering into a contract, depending on the circumstances.

Event and training administration - Contract, where applicable, or legitimate interests where appropriate.

Event accessibility and dietary requirements - The applicable Article 6 lawful basis. If special-category personal data is processed, an additional Article 9 condition and any required Data Protection Act 2018 safeguards must also apply.

General communications - The lawful basis appropriate to the purpose and nature of the communication, such as contract or legitimate interests.

Direct marketing - Consent where required by PECR, or another applicable approach where permitted by law. The UK GDPR lawful basis must also be identified where personal data is processed.

Marketing preferences and suppression records - The appropriate lawful basis for recording and respecting preferences and objections, taking account of applicable legal obligations and legitimate interests.

Website enquiries - Steps taken at the individual’s request before entering into a contract, where applicable, or legitimate interests.

Complaints - Legitimate interests or legal obligation, depending on the nature of the complaint and any applicable legal requirements.

Legal and regulatory requirements - Legal obligation, where processing is necessary to meet a legal requirement.

Information security and system administration - Legitimate interests or legal obligation, depending on the specific activity.

HCA will identify the lawful basis that applies to each processing activity and will not rely on a basis simply because it is listed above.

9. Consent

Where we ask you to provide consent, we will explain clearly what you are agreeing to.

Consent will be:

  • Voluntary;
  • Specific;
  • Informed;
  • Based on a clear affirmative action; and
  • Capable of being withdrawn.

You can withdraw consent at any time.

Withdrawing consent will not affect processing that took place lawfully before the withdrawal.

Agreeing to this Privacy Notice is not the same as consenting to direct marketing.

Where we require consent for marketing or another specific processing activity, we will ask for this separately.

10. Why We Are Asking Members to Review Their Preferences

HCA is developing and improving ways of communicating with and supporting members, including the Member Directory.

As our systems, services and uses of information develop, we want to make sure that the information we hold is:

  • Accurate;
  • Up to date;
  • Relevant;
  • Appropriately used; and
  • Reflective of your current preferences.

We may therefore periodically ask members to review and update their information and communication preferences.

This helps HCA maintain accurate records and gives members a clear opportunity to tell us how they would like their information to be used.

Completing a preferences form does not mean that you are being asked to consent to every use of your information.

Different processing activities may have different lawful bases.

Where HCA needs consent for a particular purpose, that consent will be requested separately and clearly.

11. Data Sharing

HCA may share personal information where this is lawful, necessary and appropriate.

Depending on the circumstances, this may include sharing information with:

  • HCA staff and authorised representatives;
  • Service providers;
  • Technology and CRM providers;
  • Event and training providers;
  • Professional advisers;
  • Project partners;
  • Delivery partners;
  • Regulatory or statutory bodies where required or permitted;
  • Organisations supporting the delivery of HCA services or programmes; or
  • Other organisations where there is an appropriate lawful basis.

We will only share information that is necessary for the relevant purpose.

Where a third party processes personal information on our behalf, HCA will put appropriate contractual and security arrangements in place.

We will not sell your personal information.

12. Our Digital Systems and Service Providers

HCA uses a range of digital systems to operate its services and manage information.

These may include systems used for:

  • Membership management;
  • CRM;
  • Email;
  • Event management;
  • Online forms;
  • Document storage;
  • Communications;
  • Website management; and
  • Other business activities.

HCA will assess suppliers and systems proportionately and take appropriate steps to protect personal information.

Where suppliers process personal information on behalf of HCA, we will ensure that appropriate data protection and security arrangements are in place.

13. International Transfers

HCA uses digital systems and service providers to support its activities. Depending on the systems and services used, personal information may be stored or accessed in locations outside the United Kingdom.

HCA will check the arrangements of its relevant systems and service providers to establish whether personal information is transferred outside the UK or otherwise made accessible from overseas.

Where a restricted transfer of personal information takes place, HCA will ensure that the applicable legal requirements are met. This may include relying on UK adequacy regulations or putting appropriate transfer safeguards in place, together with any required assessment or supplementary measures.

Information about relevant international transfers and the safeguards used will be provided where required by data protection law.

14. How We Protect Your Information

HCA takes appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing.

These measures may include:

  • Access controls;
  • Password protection;
  • Multi-factor authentication where available;
  • Secure systems;
  • Staff training;
  • Restricted access;
  • Appropriate backups;
  • Security updates;
  • Secure disposal; and
  • Incident management procedures.

Access to personal information is restricted to people who need it for legitimate HCA purposes.

No method of transmission or storage can be guaranteed to be completely secure. However, HCA will take proportionate steps to reduce the risks to personal information.

15. How Long We Keep Your Information

HCA will only keep personal information for as long as it is necessary for the purpose for which it was collected, unless we are required or permitted by law to retain it for longer.

Retention periods may depend on:

  • The type of information;
  • The purpose for which it is held;
  • Membership arrangements;
  • Legal requirements;
  • Accounting requirements;
  • Contractual requirements;
  • Regulatory requirements; and
  • Potential disputes or legal claims.

Specific retention periods are determined through HCA's Records Retention Schedule and related information governance arrangements.

When information is no longer required, it will be securely deleted, destroyed or anonymised where appropriate.

16. Your Data Protection Rights

Depending on the circumstances, you have rights under data protection law, including:

  • The right to be informed about how your personal information is used;
  • The right to access your personal information;
  • The right to have inaccurate or incomplete information corrected;
  • The right to request erasure of your personal information;
  • The right to request restriction of processing;
  • The right to object to certain processing;
  • The right to data portability in certain circumstances; and
  • Rights relating to automated decision-making and profiling where applicable.

You have an absolute right to object to the use of your personal information for direct marketing.

Not all rights apply in every circumstance. Where a particular right does not apply, HCA will explain this where appropriate.

17. How to Exercise Your Rights

If you would like to:

  • Update your information;
  • Correct inaccurate information;
  • Change your communication preferences;
  • Change your Member Directory preferences;
  • Withdraw consent;
  • Object to direct marketing;
  • Request access to your information; or
  • Exercise another applicable data protection right,

Please contact HCA using the details in Section 23.

We may need to verify your identity before responding to certain requests.

We will respond to valid requests within the applicable statutory timeframe.

18. Keeping Your Information Accurate

We rely on our members and contacts to help us keep information accurate and up to date.

Please let us know if:

  • Your name changes;
  • Your role changes;
  • Your organisation's details change;
  • Your contact details change;
  • Your organisation's services change; or
  • Any other information we hold is incorrect.

Members will also have an opportunity to review information held for the Member Directory.

19. Cookies and Website Information

HCA’s website may use cookies and similar technologies to support website functionality, security, preferences and website usage analysis.

Cookies and similar technologies may be used by HCA or by third-party services integrated into the website. The information collected and the purposes for which it is used depend on the technologies operating on the website.

Where consent is required by law, HCA will obtain valid consent before using non-essential cookies or similar technologies. Essential technologies may be used without consent only where the applicable legal exemption applies.

Website visitors should be provided with clear and accessible information explaining the cookies and similar technologies in use, their purposes, any relevant third parties, and how preferences can be managed or withdrawn where applicable.

HCA will review its website technologies and consent arrangements to ensure that the information provided to visitors accurately reflects the technologies in use and that applicable consent requirements are met.

Further information about the cookies and similar technologies used on the HCA website will be provided through our Cookie and Website Technologies Notice.

20. Children

HCA's services and membership activities are directed towards adult social care organisations and professionals.

We do not knowingly collect personal information from children unless there is a specific and lawful reason to do so.

Where we do process children's personal information, we will take appropriate steps to ensure that the processing is lawful, fair and transparent and that appropriate safeguards are in place. 

21. Automated Decision-Making and Profiling 

HCA does not currently use personal information to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If this changes, HCA will update this Privacy Notice and provide any additional information required by data protection law.

22. Changes to This Privacy Notice 

HCA may update this Privacy Notice from time to time.

Changes may be made where there are:

  • Changes to legislation;
  • Changes to ICO guidance;
  • Changes to our services;
  • Changes to our digital systems;
  • Changes to the Member Directory;
  • Changes to how we use personal information; or
  • Other relevant organisational changes.

The latest version will be made available on the HCA website.

Where appropriate, we may also provide additional notification of significant changes.

The effective date and version number will be shown at the beginning of this Privacy Notice.

23. Contacting HCA

If you have questions about this Privacy Notice, how HCA handles personal information, or wish to exercise your data protection rights, please contact us.

Hampshire Care Association
132 Bournemouth Road
Chandler's Ford
Eastleigh
Hampshire
SO53 3AL

General enquiries: [email protected]

Data protection/privacy enquiries: [email protected]

Telephone: 07434 571 207

24. Data Protection Complaints 

If you are concerned about how HCA has collected, used, stored or otherwise handled your personal information, you can make a data protection complaint to HCA.

You can make a complaint using:

Email: [email protected]

Online: https://www.hampshirecare.org/pages/about-us--

Post:
Hampshire Care Association
132 Bournemouth Road
Chandler's Ford
Eastleigh
Hampshire
SO53 3AL

You do not need to use a particular form or wording to make a complaint.

We will acknowledge receipt of a data protection complaint within 30 days and will investigate and respond without undue delay in accordance with our Data Protection & Privacy Complaints Procedure.

If you require reasonable adjustments or assistance to make a complaint, please contact us.

25. Complaining to the Information Commissioner's Office

If you remain dissatisfied with how HCA has handled your personal information, you have the right to complain to the Information Commissioner's Office (ICO).

The ICO is the UK's independent supervisory authority for data protection.

Information Commissioner's Office

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

We encourage you to contact HCA first so that we have the opportunity to investigate and resolve your concerns.

26. Related HCA Information and Policies 

This Privacy Notice is supported by HCA's internal information governance and data protection arrangements.

These may include:

  • Data Protection Policy;
  • Direct Marketing Policy;
  • Records Retention Schedule;
  • Data Breach / Incident Procedure;
  • Data Protection Impact Assessment Procedure; and
  • Cookie and Website Technologies Notice.

Internal policies are not necessarily published on the HCA website. Where members of the public need information about how HCA processes their personal information, this Privacy Notice and any relevant additional privacy information will provide the appropriate public-facing information.

End of Policy

HAMPSHIRE CARE ASSOCIATION

Cookie & website technologies policy

Document Title: Cookie & Website Technologies Notice
Document Owner: Hampshire Care Association
Policy Owner: Data Protection Officer
Version: 1.0
Status: Approved
Approved By: Emma Heath
Approval Date: 12/11/2026
Effective Date: 12/11/2026
Review Date: 12 Months From Approval
Related Documents: Data Protection Policy; Privacy Notice; Data Protection & Privacy Complaints Procedure; Data Protection Impact Assessment Procedure; Records Retention Schedule; Information Security/Cyber Security Arrangements; Business Continuity Arrangements

1. Purpose

This Cookie Policy explains how Hampshire Care Association (HCA) uses cookies and similar technologies on its website, www.hampshirecare.org.

It explains what these technologies do, why we use them and how visitors can manage their preferences.

This policy should be read alongside HCA's Privacy Notice and Data Protection Policy.

2. What are cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function, remember preferences and understand how visitors use their pages.

Some websites also use similar technologies, such as local storage, which can store information on your device in a similar way.

3. How HCA uses cookies and similar technologies

HCA uses cookies and similar technologies for the following purposes:

Essential website functionality
Some technologies are necessary for the website to operate correctly. These may support website security, navigation and session management.

Website analytics
HCA uses Google Analytics 4 (GA4) to understand how visitors use our website and to help us improve its content, functionality and performance.

This includes information such as:

  • The number of website visitors.
  • Which pages are visited.
  • How visitors find our website.
  • General website usage and engagement.

HCA uses analytics solely to understand website usage and improve our website. We do not use Google Analytics for advertising or individual profiling.

Google Signals and Google's data sharing with other Google products and services are disabled. Analytics data retention is set to 14 months.

Website forms and third-party services
Our website uses Mailchimp to support online forms and sign-up functionality. Mailchimp may use cookies or similar technologies to support these services.

The website also uses search functionality, which may store information locally on your device to support its operation.

These services may use their own technologies and are subject to the relevant providers' privacy information.

4. Managing your cookie preferences

When you visit the HCA website, you are shown a cookie notice explaining our use of analytics.

You can choose to accept analytics or opt out using the options provided.

If you select Opt out, a preference is stored on your device to indicate that you do not wish to participate in website analytics. This preference is used to prevent analytics from running on subsequent page loads.

Please note that opting out does not automatically remove analytics cookies that may already have been stored on your device. You can also delete cookies through your browser settings.

HCA is working with its website provider to update the cookie preference arrangements. This policy will be reviewed when those changes are complete.

You can manage or delete cookies through your browser settings at any time.

5. Third-party services

Some cookies and similar technologies are provided by third parties whose services are used on our website, including Google Analytics and Mailchimp.

HCA does not control all technologies used by these providers. Further information about their data processing practices can be found in their respective privacy information.

6. Changes to this policy

We may update this Cookie Policy from time to time to reflect changes to the cookies and technologies used on our website, or changes in legal and regulatory requirements.

Any updates will be published on this page.

7. Contact

If you have any questions about this Cookie Policy or how HCA uses cookies and similar technologies, please contact Hampshire Care Association using the contact details provided on our website.

Hampshire Care Association
132 Bournemouth Road
Chandler's Ford
Eastleigh
SO53 3AL

www.hampshirecare.org

End of Policy

HCA WhatsApp Community Privacy & Use Notice

Purpose of This Community

This WhatsApp Community is a space for peer support, informal communication, and updates relevant to [Registered Managers, Deputies, Owners, etc.] from HCA member organisations. HCA may also share official news, events, and opportunities here.

Who Can Join

This group is for individuals employed by active, paid HCA member organisations. HCA reserves the right to verify members against our membership database. If your organisation's membership lapses, your access may be revoked.

Data Privacy

By joining this group, your name and phone number will be visible to all group participants.

Your data will only be used by HCA to manage group access and monitor appropriate use.

We will not share your personal information outside this group or use it for marketing without your consent.

You can request to be removed from the group or have your information deleted at any time by contacting us at [insert HCA contact email].

For more details on how we manage member data, see our full [Privacy Policy here].

Group Rules

To ensure a respectful and supportive environment, we ask that all members:

  • Post respectfully and professionally.
  • Do not share any confidential or identifiable service user information.
  • Refrain from spreading unverified or misleading information.
  • Avoid forwarding sensitive content outside the group.
  • Contact an admin if you see content that may breach these rules.

Your Consent

By joining this group, you acknowledge:

  • You are part of a member organisation;
  • You understand your contact details are visible to others;
  • You agree to follow the group rules and privacy standards set out above.