Privacy policy

This policy explains how Your Autumn Years Ltd uses personal information when you visit this website, contact us about care, or ask about working with us. Last updated: 14 November 2026.

Your Autumn Years Ltd is the controller of the personal information described here. That means we decide how and why it is used, and we are responsible for looking after it.

• Your Autumn Years Ltd, company number 11277828
• Registered office: 1a Sugham Lane, Heysham, Morecambe, Lancashire, LA3 2DR
• Email: autumnyearsheysham@gmail.com
• Telephone: 01524 416546
• Registered with the Information Commissioner's Office (ICO), registration reference ZA521740

Our contact for data protection questions is Angie (Sarah Angela Ageros), our Data Protection Officer. You can reach her using the email address or phone number above.

This policy covers this website, enquiries you make to us by phone, email or letter, and people who ask about working with us.

[To confirm:] If we provide care to you or to someone in your family, we will give you a separate privacy notice that explains how we use and keep care records. That notice, not this one, covers care records.

When you contact us about care. Your name and contact details, the name and contact details of the person who may need care if that is someone else, and what you tell us about the situation. This can include information about health, which the law calls special category data.

When you ask about working with us. Your name and contact details, your work history, qualifications and training, and anything else you choose to send us, such as a CV. If you go on to apply, we will tell you about the checks we must carry out before anyone can work in care, such as references and a Disclosure and Barring Service (DBS) check.

When you visit this website. This website has no contact form, no accounts and no analytics. It does not set cookies for visitors. Like any website, the servers that deliver it receive technical information such as your IP address, browser type and the pages requested. Our hosting provider keeps this in server logs for security and to keep the site running.

This website's theme loads its fonts from Google Fonts. Google Fonts does not set cookies, but your browser sends your IP address to Google when a page loads so the fonts can be delivered.

[Confirm: we do not record phone calls.]

Data protection law says we must have a lawful basis for each use of personal information.

• Answering your enquiry and talking to you about care. Our legitimate interests in responding to people who contact us, and, where you are asking us to arrange care for you, taking steps at your request before entering into a contract.
• Health information you share when asking about care. As well as a lawful basis, we need a condition for using health information. We rely on the condition for health and social care purposes (UK GDPR Article 9(2)(h), with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2). [Confirm with your adviser.]
• Considering people who ask about working with us. Taking steps at your request before entering into a contract, and our legitimate interests in recruiting staff.
• Pre-employment checks for care roles, including DBS checks. Our legal obligations as a provider registered with the Care Quality Commission. For health and criminal records information, we rely on the employment condition (Data Protection Act 2018, Schedule 1, Part 1, paragraph 1). [Confirm with your adviser.]
• Running and securing this website. Our legitimate interests in keeping the website available and secure.
• Meeting our legal and regulatory duties. Legal obligation, for example when a regulator asks for information.

We do not sell personal information, use it for marketing without asking you first, or make decisions about you by automated means.

We only share personal information when we need to. The people and organisations we may share it with are:

• our email provider, Google LLC, which provides our email through a free Gmail consumer account (not Google Workspace);
• our website hosting provider and IT support provider, Go Host Ltd;
• [any other service providers, such as accountants or a care management system, if they can see enquiry or applicant information];
• referees and the Disclosure and Barring Service, if you apply to work with us;
• regulators and public bodies when the law requires it, such as the Care Quality Commission, the ICO, the police or a court;
• health and social care professionals, but only with your agreement or where the law allows, for example to protect someone from serious harm.

Our service providers may only use the information to provide their service to us.

Our email is a free Gmail account, which is a consumer Google service, not a Google Workspace (business) account. It is provided by Google LLC. Emails you send us may be stored or processed in the United States and other countries. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). Google also relies on standard contractual clauses for transfers where required. These are safeguards recognised by UK law. Google's privacy policy is at https://policies.google.com/privacy and its terms of service are at https://policies.google.com/terms. [Confirm, and add any other provider that stores data outside the UK.]

We keep personal information only for as long as we need it, or for as long as we are expected to keep it under the law or sector guidance. Care and staff record periods below are in line with the NHS England Records Management Code of Practice (the Code is guidance that care providers are expected to follow, not a statute). After the minimum period we review the record and destroy it if it is no longer needed.

• enquiries that do not lead to care: 12 months from our last contact;
• enquiries that do lead to care: these become part of the care record. In line with the Code, we keep adult social care records (including care plans) for at least 8 years after our care ends or the person dies;
• people who ask about work or apply but are not appointed: 6 months after the role is filled;
• people we appoint: their information moves to their staff record. In line with the Code, we keep staff records until the staff member's 75th birthday (some organisations reduce the detailed file to a summary after about six years, and keep the summary until that date);
• Disclosure and Barring Service (DBS) certificate information: no longer than 6 months after the recruitment decision, in line with DBS and ICO guidance. We may keep a record of the date of issue, the type of check, the certificate reference number and the recruitment decision on the staff record;
• payroll, tax and company accounting records: 6 years from the end of the financial year they relate to, in line with HMRC and company record-keeping rules;
• website server logs: Go Host Ltd keeps these for 24 months;

We use password-protected accounts, limit access to the people who need it, and only use providers who protect information properly. The website is served over an encrypted connection. Email is not completely secure, so please think about how much health detail you put in an email. You are always welcome to phone us instead. [Confirm, and add anything else you do, such as two-step sign-in on email.]

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to limit how we use your information;
• object to us using your information where we rely on legitimate interests;
• ask us to move information you gave us to another organisation, in some cases;
• withdraw your consent at any time, where we rely on consent.

Some of these rights depend on the reason we hold the information. To use any of them, email autumnyearsheysham@gmail.com or call 01524 416546. There is usually no charge, and we will reply within one month.

If you are unhappy with how we have used your information, please tell us first and we will try to put it right.

You can also complain to the Information Commissioner's Office:

• Online: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We will update this policy if the way we use personal information changes. The date at the top shows when it was last updated. This version was last updated on 14 November 2026.