Logo of Acorn Scotland featuring a large green tree with a person standing underneath and a child on a swing hanging from a branch, with the words 'acorn' in green and 'SCOTLAND' in gray underneath.

Privacy Policy

Last updated: [8/11/25]

1. Introduction

At Acorn Scotland LTD we are committed to protecting the privacy and personal data of the children and young people in our care, their families, staff, and other individuals we work with.

This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with:

  • UK General Data Protection Regulation (UK GDPR)

  • Data Protection Act 2018

  • Relevant Scottish legislation and Care Inspectorate requirements

2. Data Controller

We are the Data Controller for the personal data we process.

Organisation name: Acorn Scotland Ltd
Address: 27 McGown Street, Paisley, PA3 1QJ
Telephone: 07725543515
Email: mario@acornscotland.co.uk

Data Protection Lead: [Mario Cassani / CEO]

3. Whose Data We Collect

We may collect and process personal data relating to:

  • Children and young people in our care

  • Parents, carers, and family members

  • Staff, volunteers, and agency workers

  • Social workers and professionals

  • Visitors and contractors

4. Types of Personal Data We Collect

a) Children and Young People

This may include:

  • Name, date of birth, address, NHS number

  • Care plans, placement information

  • Health and medical records

  • Education records

  • Behavioural and incident reports

  • Safeguarding and risk assessments

  • Photographs (with appropriate consent)

b) Families and Carers

  • Contact details

  • Relationship to the child

  • Relevant background information

c) Staff and Others

  • Contact details

  • Employment records

  • Training and qualification records

  • Disclosure Scotland information

  • CCTV images (where applicable)

5. Special Category Data

We process special category data such as:

  • Health information

  • Safeguarding and child protection records

  • Ethnicity or religious beliefs (where relevant to care)

This data is handled with extra safeguards as required by law.

6. Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Legal obligation – to comply with childcare, safeguarding, and employment law

  • Public task – providing regulated care services

  • Vital interests – protecting a child’s life or wellbeing

  • Contract – employment or service agreements

  • Consent – where required

7. How We Use Personal Data

We use personal data to:

  • Provide safe and appropriate care

  • Safeguard children and young people

  • Communicate with families and professionals

  • Meet Care Inspectorate and legal requirements

  • Manage staff employment and training

  • Investigate incidents or complaints

8. Sharing Personal Data

We may share personal data with:

  • Local authorities and social work departments

  • NHS and health professionals

  • Police and safeguarding agencies

  • Education providers

  • Care Inspectorate and regulatory bodies

We only share information when lawful, necessary, and proportionate.

9. Data Security

We take appropriate measures to protect personal data, including:

  • Secure electronic systems and password protection

  • Locked filing cabinets for paper records

  • Staff training on confidentiality and data protection

  • Access restricted to authorised personnel only

10. Data Retention

We retain personal data only for as long as necessary and in line with:

  • Legal requirements

  • Local authority guidance

  • Care Inspectorate expectations

Retention schedules are reviewed regularly.

11. Individual Rights

Under UK GDPR, individuals (or those with parental responsibility) have the right to:

  • Access their personal data

  • Request correction of inaccurate data

  • Request erasure (where applicable)

  • Restrict or object to processing

  • Data portability

  • Withdraw consent (where processing is based on consent)

Requests should be made in writing to the Data Protection Lead.

12. Complaints

If you are unhappy with how we handle personal data, you can contact:

  • Our Data Protection Lead (details above)

  • Information Commissioner’s Office (ICO)
    Website: www.ico.org.uk
    Helpline: 0303 123 1113

13. CCTV (if applicable)

Where CCTV is used:

  • It is for safety and safeguarding purposes only

  • Clear signage is displayed

  • Footage is stored securely and retained for a limited period

14. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available at the care home and upon request.