How we look after your information

DiRich Specialist Community Support Ltd respects your privacy and is committed to protecting your personal information.

This policy explains how we collect, use, store, protect and share personal information when you:

• Visit our website
• Contact us by telephone, email or online form
• Make an enquiry or referral
• Receive or arrange support from us
• Act on behalf of a child, family member or another individual
• Work with us as a professional, supplier or contractor
• Apply for employment or another role with DiRich
• Make a complaint, provide feedback or raise a safeguarding concern

We process personal information in accordance with the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable UK data-protection legislation.

DiRich Specialist Community Support Ltd is the data controller responsible for deciding how and why your personal information is used.

Company name: DiRich Specialist Community Support Ltd
Company number: 17196962
Service base: Burton upon Trent and selected surrounding areas
Email: info@dirichsupport.com
Telephone: 01283 351888

Registered office:
66 Paul Street, London, England, EC2A 4NA

Our registered office is used for company registration and official correspondence. DiRich is not a London-based support provider and does not deliver services from this address.

Please do not send medical records, identification documents or other sensitive personal information to the registered office without contacting us first.

What we collect depends on your relationship with DiRich and the reason you contact us.

Personal & contact information

• Name, date of birth or age group, address or general location
• Telephone, email, preferred method of communication
• Parent, carer, representative or emergency-contact details
• Details of a person authorised to act on someone's behalf

Enquiry, referral & support information

• Reason for enquiry/referral; type of support requested
• Interests, strengths, preferences and personal goals
• Communication and accessibility requirements
• Education, employment, volunteering or community-access goals
• Funding/local-authority arrangements; consultation records
• Suitability & risk assessments; support plans; attendance records
• Incident, accident or safeguarding records; feedback and complaints

Sensitive / special-category information

• Physical or mental health, disability, learning disabilities
• Autism or neurodivergence; communication or sensory needs
• Medication arrangements (DiRich does not administer or manage medication)
• Racial or ethnic origin; religious or philosophical beliefs
• Dietary, cultural or faith-related requirements

Please do not send complete medical records or unnecessary sensitive information through our general contact form. Where more is genuinely required, we'll explain what, why and how.

Safeguarding information

• Safeguarding concerns; risk of abuse, neglect, exploitation or harm
• Incidents involving a child or an adult at risk
• Information from family, professionals or public authorities
• Actions taken to protect an individual or report a concern

Financial & administrative information

• Payment, invoicing and funding arrangements
• Direct-payment or local-authority information; transaction records

We will not normally ask you to submit full bank-card details through our website contact form.

Website & technical information

• IP address, browser/device type, pages visited, date/time of access
• Security logs and cookie preferences (see our Cookie Policy)

Recruitment information

• Contact details, employment history, qualifications and references
• Right-to-work information and interview/assessment information
• Reasonable-adjustment information

Criminal-offence and vetting information

• DBS status or certificate information, only where the role and law allow or require it
• Relevant allegations, convictions, cautions or safeguarding restrictions where lawfully necessary

Criminal-offence information is subject to separate legal safeguards. We only process it where we have an appropriate Article 6 lawful basis and the required legal authority or Schedule 1 condition under the Data Protection Act 2018.

When information is required

You do not need to provide personal information simply to browse our website. If specific information is needed to assess a referral, enter into or perform a service agreement, complete lawful recruitment checks, protect someone from harm or meet a legal duty, we will explain this. We may be unable to proceed if information that is genuinely required is not provided.

We may obtain information:

• Directly from you
• From a parent, family member, carer, advocate or authorised representative
• From a social worker, school, college, local authority, healthcare professional or other referrer
• From an employer, funding body or community organisation
• From staff, contractors or service providers
• Through our website, emails, telephone calls and contact forms
• From public authorities or emergency services where necessary and lawful

Where someone provides information about another person, they should have that person's permission or another lawful authority to share it, unless the sharing is for safeguarding, emergency or another lawful purpose.

We may use personal information to:

• Respond to enquiries and referrals; communicate with individuals, families, representatives and professionals
• Understand the support being requested and whether it's suitable for us to provide
• Complete consultations, assessments and risk assessments
• Develop, review and deliver agreed support plans
• Protect the health, safety and wellbeing of individuals and staff
• Manage safeguarding concerns; contact emergency services or public authorities where necessary
• Maintain accurate service and communication records
• Manage service agreements, payments and invoices
• Respond to complaints and feedback; investigate incidents or concerns
• Establish, exercise or defend legal claims
• Recruit, train and manage workers
• Meet insurance, tax, accounting and other legal obligations
• Operate, maintain and secure our website and business systems
• Improve the quality, accessibility and safety of our services

We do not sell personal information, and we do not use it for unrelated purposes without informing the person concerned and identifying an appropriate lawful basis.

Contract / steps before a contract

Responding to support requests, preparing service agreements, delivering agreed services and managing payments.

Legal obligation

Safeguarding, health & safety, employment, tax, insurance, data protection, court orders and lawful requests.

Legitimate interests

Managing enquiries, maintaining records, improving quality, protecting systems, communicating with professionals, and protecting individuals, staff and the business — always weighed against your rights and freedoms.

Recognised legitimate interests

Where the legal conditions are met, this may include safeguarding vulnerable individuals, preventing or detecting crime, and responding to certain emergencies.

Vital interests

In a serious emergency, we may use or share information to protect someone's life or physical safety.

Consent

Used where processing is genuinely optional, such as certain photographs, testimonials or promotional communications. You can withdraw consent at any time, though this won't affect lawful processing that already took place. Consent is not always the right basis for safeguarding matters.

Sensitive or special-category information receives additional legal protection. Where we process it, we need both a general lawful basis and a special-category condition, which may include:

• Explicit consent
• Provision or management of health/social-care-related support, where legal and confidentiality conditions are met
• Safeguarding children or individuals at risk
• Substantial public interest reasons permitted by UK law
• Employment and social-protection obligations
• Protecting someone's vital interests when they can't consent
• Establishing, exercising or defending legal claims

We only collect sensitive information that is relevant and reasonably necessary for the stated purpose. Criminal-offence information is not special-category information and is handled under separate legal rules.

Where necessary, proportionate and lawful, we may share relevant information with:

• The person receiving support, and their parents/carers/advocates/representatives with permission or appropriate authority
• DiRich directors, employees and authorised workers who need it
• Social workers, local authorities, schools, colleges and education professionals
• Healthcare or other professionals involved in the individual's support
• Funding bodies or commissioners; safeguarding teams
• Police, emergency services or other public authorities
• Insurers, professional advisers, accountants, legal advisers and auditors
• Website, email, IT, cloud-storage, payment and accounting providers
• Regulators, courts or government bodies where legally required

Service providers acting on our behalf must only use information for agreed purposes and protect it appropriately. We will not share information merely because someone is a relative or friend — we consider wishes, capacity, safety, confidentiality and legal authority. We may share without consent where necessary to protect a child or adult at risk, respond to an emergency, comply with a court order or meet another legal obligation.

We aim to use systems and providers that store information within the United Kingdom, or another location recognised as providing an adequate level of protection.

Some technology providers may process information outside the UK. Where an international transfer takes place, we use an appropriate legal safeguard, such as:

• UK adequacy regulations
• The UK International Data Transfer Agreement
• An approved UK addendum to standard contractual clauses
• Another safeguard permitted by UK data-protection law

We keep personal information only for as long as reasonably necessary, taking into account its nature, whether support was provided, the person's age, safeguarding considerations, contracts, legal limitation periods, insurance, tax rules, and any ongoing complaint or claim.

Our normal approach

• General enquiries that don't proceed: up to 12 months after last contact, unless there's a safeguarding or legal reason to keep longer
• Service, support, risk and incident records: for a period determined by the person's age, safeguarding needs, contractual requirements, insurance requirements and applicable legal limitation periods
• Safeguarding records: may be kept longer where necessary to protect individuals or meet legal/professional requirements
• Invoices & accounting records: normally at least 6 years
• Unsuccessful recruitment applications: normally up to 6 months after the decision
• Website & security logs: only as long as needed for operation, troubleshooting and security

When information is no longer required, it's securely deleted, destroyed or anonymised.

We use proportionate technical and organisational measures to protect personal information against unauthorised access, accidental loss, inappropriate alteration, misuse, unlawful disclosure and accidental destruction. These may include:

• Restricted access based on job responsibilities
• Password-protected systems and multi-factor authentication where available
• Secure email and website connections
• Confidentiality requirements and staff training
• Secure storage and disposal procedures
• System updates and security monitoring
• Appropriate contracts with service providers

Only individuals who need personal information for an authorised purpose have access to it. Although we take reasonable steps, no internet transmission or electronic storage system can be guaranteed completely secure.

DiRich may receive or process information relating to children aged eight and over. We recognise this requires particular care, so we will:

• Use clear, age-appropriate explanations where practical
• Collect only information reasonably necessary for the proposed support
• Consider the child's wishes, understanding, rights and best interests
• Involve a person with parental responsibility or another authorised representative where appropriate
• Restrict access to those who genuinely require the information
• Avoid using children's information for direct marketing or inappropriate profiling
• Follow safeguarding procedures where a child may be at risk of harm

A parent or representative should not provide unnecessary sensitive information about a child through the general website form.

Depending on the circumstances and lawful basis used, you may have the right to:

• Ask whether we hold personal information about you, and request a copy
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information in certain circumstances
• Ask us to restrict how information is used, or object to certain processing
• Request transfer of information in a portable format where applicable
• Withdraw consent where processing is based on consent
• Ask about safeguards used for an international transfer
• Raise a complaint about how your information has been handled

These rights are not absolute — the law may permit or require us to continue holding or using information in some circumstances.

Your right to object

Where we rely on legitimate interests or recognised legitimate interests, you may object to that processing. We will stop unless we can demonstrate compelling lawful grounds to continue, or the information is needed for legal claims. You can always object to direct marketing.

To exercise a right, contact info@dirichsupport.com or 01283 351888, clearly explaining what you're requesting. We may ask for identity confirmation where reasonably necessary. We'll respond within the legal timescale — normally free of charge, though the law allows a reasonable fee or refusal for manifestly unfounded or excessive requests.

DiRich does not currently make decisions about access to support solely through automated processing where the decision would have a legal or similarly significant effect.

Enquiries and referrals are always considered by an appropriate person, and we do not use sensitive information to conduct automated marketing profiles.

You have the right to complain if you're concerned about how DiRich has collected, used, stored, shared or protected personal information.

Contact info@dirichsupport.com (suggested subject line: "Data Protection Complaint") or 01283 351888. We will acknowledge your complaint within 30 days, take appropriate steps to investigate it, keep you informed and explain the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Online: Make a complaint to the ICO

You may contact the ICO at any time, although giving DiRich a chance to address the concern first may resolve it more quickly.

Our website may contain links to other organisations' websites or social-media pages.

DiRich is not responsible for the privacy practices, security or content of external websites. Please review the privacy information provided by the relevant organisation before submitting personal information.

We may update this policy when:

• Our services or working practices change
• We introduce a new system or service provider
• Data-protection law or regulatory guidance changes
• We identify a need to provide clearer information

The latest version will always be published on our website with the updated effective date.

For questions, requests or complaints concerning personal information, please contact:

DiRich Specialist Community Support Ltd
Email: info@dirichsupport.com
Telephone: 01283 351888
Company number: 17196962

Registered office:
66 Paul Street, London, England, EC2A 4NA

The registered office is for statutory and official correspondence only. DiRich's community support services are based in Burton upon Trent and selected surrounding areas.