About this policy

This privacy policy explains how Charis MC Ltd (“we”, “us”, “our”) collects, uses and protects your personal information when you visit our website, www.charismc.co.uk, and when you contact us or submit a form through it.

This policy covers visitors to our website – for example, professionals making a referral, people enquiring about our services, and people applying for a job. It does not cover the personal information we hold about the young people we support. That is explained in our separate [Service User Privacy Notice], which reflects our duties as a provider of supported accommodation and the additional safeguards that apply to sensitive information.

We are committed to protecting your privacy and handling your information openly and in line with UK data protection law – the UK GDPR and the Data Protection Act 2018.

What information we collect

a. Information you give us through our website forms

Contact form: your name, email address, phone number, organisation (if given) and the content of your message.
Refer a young person / enquiry form: your name, job role, referring organisation or local authority, team, your contact details and preferred contact method, the service you are enquiring about, and the details of your enquiry. We ask referrers not to include a young person’s full name or sensitive details in this form (see “Sensitive information” below).
Job application form: your name, contact details, the role you are applying for, confirmation of your right to work in the UK, driving-licence information (where relevant), your covering message, and any CV or supporting documents you upload.
Complaints and feedback form: your name (which you may choose not to give), your contact details and preferred contact method, your relationship to us (for example, a professional, a family member or advocate, or a person we support), the service concerned, and the details of your feedback or complaint.

b. Information we collect automatically

When you use our website we collect certain information automatically through cookies and similar technologies, including your IP address, device and browser information, website-usage data, and any accessibility preferences you set. For full details, see our Cookie Policy.

c. Information we receive from third parties

In the course of our work we may receive information about individuals from third parties such as local authorities and other professionals who refer young people to us. We do not purchase personal information from data brokers, aggregators, directories or marketplaces.

Sensitive information (special category and criminal-offence data)

Some information you send us – for example, in a complaint, or if a referrer includes it – may reveal health or other sensitive matters. Please do not submit a young person’s sensitive or identifying information through our website forms. Any special category data (such as health information) and criminal-offence data relating to the young people we support is processed under our Service User Privacy Notice, using the appropriate conditions under Articles 9 and 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 (such as the safeguarding and health/social-care conditions), not under this website policy.

How we use your information

We use the information we collect to:

provide and maintain our website and keep it secure;
respond to and manage your enquiries, referrals and correspondence;
assess and administer job applications;
handle and learn from feedback and complaints;
fulfil a contract with you (for example, an employment or supplier contract);
evaluate and improve our services; and
understand how our website is used (usage trends).

We do not use your information for targeted advertising, and we do not currently send marketing or promotional communications through our website.

Lawful bases for processing

UK data protection law requires us to have a lawful basis for processing your personal data. Depending on the activity, we rely on:

Consent – for non-essential cookies and analytics, and for anything else where we ask for your agreement. You can withdraw consent at any time.

Performance of a contract – where we have (or are entering into) a contract with you, such as employment or supplier contracts, and pre-contract steps when you apply for a role.

Legal obligations – where we must process information to comply with the law, including safeguarding, regulatory, employment and tax obligations.

Legitimate interests – where processing is reasonably necessary for our legitimate interests and does not override your rights. Where we rely on legitimate interests, these are:

Keeping our website and its users secure – we use security and anti-bot tools (Cloudflare and Google reCAPTCHA) to protect our website and our enquiry, application and feedback forms from spam, fraud, malicious traffic and cyberattacks. Data processed: IP address and technical/device information.
Responding to and managing enquiries and referrals – when you contact us or submit an enquiry or referral, we process your details to reply, manage your request and keep a record of our correspondence. Data processed: your name, role, organisation, contact details and the content of your message.
Managing recruitment -when you apply for a role, we process your application to assess your suitability and administer our recruitment process. Data processed: your name, contact details, CV and right-to-work information.
Handling feedback and complaints – we process the information you give us to respond to compliments, suggestions and complaints, and to improve our services. Data processed: your name, contact details and the details you provide.
Day-to-day administration and improving our services – general record-keeping and making sure our website and services run effectively and securely.

In each case we have weighed our interests against your rights and freedoms and are satisfied the processing is proportionate. You have the right to object to processing based on legitimate interests (see “Your rights”).

(Additional lawful bases – including legal obligation and, in emergencies, vital interests – apply to the care of the young people we support and are set out in our Service User Privacy Notice.)

Cookies and similar technologies

We use cookies and similar technologies to run our website, keep it secure and understand how it is used. Only strictly necessary cookies are set unless you agree to more. You can manage your choices at any time using the “Consent Preferences” button on our website. Full details are in our Cookie Policy.

Do Not Track

Some browsers offer a “Do Not Track” (DNT) setting that lets you signal you’d prefer your online activity not to be tracked. Because there is currently no agreed industry or legal standard for how these signals should be recognised, our website does not respond to browser DNT signals at this time.

You can, however, achieve the same outcome directly through the controls on our site. We use a consent-based approach: when you first visit, only the strictly necessary cookies needed for the website to function are set. No analytics or other non-essential cookies are used until you actively agree to them, and if you take no action, those non-essential cookies are not placed.

You stay in control at any time. Click the “Consent Preferences” button on our website to reopen the cookie banner, where you can accept or reject each category of cookie individually, or withdraw consent you have given before. Rejecting the non-essential (analytics and functional) categories gives you the same result as a Do Not Track request — those cookies will not be used. You can also block or delete cookies through your browser settings, as explained in our Cookie Policy.

Who we share your information with

We do not sell your personal information, and we do not share it for cross-context behavioural (targeted) advertising. We may share it in the following limited ways:

Service providers acting on our behalf (processors) – for example, our website hosting and domain provider (GoDaddy), our email provider, our website form tool, website analytics (Google Analytics), security and anti-spam services (Cloudflare and Google reCAPTCHA), and our cookie-consent management provider (CookieYes). These providers may only process your information on our instructions.
Local authorities and partner agencies – where we work in partnership to support young people (this mainly concerns service information covered by our Service User Privacy Notice).
Legal obligations -where we are required to disclose information to comply with the law, a court order, or a request from a public authority.
Business transfers – if we are involved in a merger, acquisition, restructuring or sale of assets, your information may be transferred as part of that process.

International data transfers

Some of the providers we use to run our website (for example, Google and Cloudflare) are based outside the UK, including in the United States. Where your personal data is transferred to a country that does not have UK “adequacy” status, we rely on appropriate safeguards – such as the UK Extension to the EU- US Data Privacy Framework, or the International Data Transfer Agreement / Standard Contractual Clauses – to make sure your data receives an equivalent level of protection.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects. Applications, referrals and complaints submitted through our website are reviewed by a member of our team.

How long we keep your information

We keep personal data only for as long as necessary for the purpose it was collected, then securely delete, anonymise or archive it. For information collected through this website:

Enquiries and general correspondence – up to 12 months after we deal with your enquiry, unless it becomes part of a referral or service record.
Job applications (unsuccessful candidates) – 6 months after the recruitment decision, then securely deleted, unless you ask us to keep your details on file for future roles.
Complaints and feedback – kept in line with our complaints policy so we can respond, review and learn from them.

Information about the young people we support, and our safeguarding, staff and financial records, is kept for the periods required by our statutory obligations and records-retention schedule, which may require some records to be held for many years. Where we no longer need personal data, we dispose of it securely.

Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you and receive a copy;
rectify information that is inaccurate or incomplete;
erase your personal data (“right to be forgotten”) in certain circumstances;
restrict our processing of your data in certain circumstances;
object to processing based on legitimate interests;
data portability – receive certain data in a portable format;
withdraw consent at any time, where we rely on consent; and
not be subject to solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or 0303 123 1113, though we’d welcome the chance to resolve your concern first.

Children and young people

This privacy policy covers visitors to our website, who we expect to be adults – for example, professionals making a referral, or people enquiring about our services or careers. It does not cover the information we hold about the young people we support; that is explained in our separate Service User Privacy Notice. Our website is not directed at children, and we do not knowingly collect personal information from children through it. If you believe a child has provided information through our website, please contact us and we will remove it.

Security of your information

We take reasonable technical and organisational measures to keep your information secure. However, no method of internet transmission or digital storage is completely secure, and while we use appropriate safeguards we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to your rights, we will notify the ICO, and you where required, in line with our legal obligations.

Links to other websites

Our website may contain links to external websites or services that we do not operate. This policy does not apply to them, and we recommend you review their own privacy policies before sharing any personal information.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in the law or our practices. The updated version takes effect from the date it is posted on this page, and we recommend you review it periodically.

Contact us

For any questions about this policy or your personal data, or to exercise your rights, please contact our Data Protection Officer:

Email: info@charismc.co.uk (please mark your message “Data Protection / DPO”)
Post: Data Protection Officer, Charis MC Ltd, 109 Humber Way, Slough, Berkshire, SL3 8SR
Via our website: using the form on our Contact us page – please mark your enquiry “Data Protection / DPO”.

You can also complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or 0303 123 1113.