Privacy Policy

Last updated: 28 August 2026

1. Who we are

Amber Residential Care Homes Ltd, trading as ARCH, is the controller responsible for the personal information described in this policy.

Company number: 04134272

Registered office: Basepoint Business Centre, 1 Winnall Valley Road, Winchester, Hampshire, England, SO23 0LD

Privacy contact: francesbaxter@amberresidentialcare.co.uk – please use the subject line Data Protection

Telephone: 07967 738617

2. Scope of this policy

This policy covers visitors to our website and people who contact us about placements, services or general matters. This may include prospective clients, relatives, advocates, commissioners, referrers, health and social care professionals and other business contacts.

If a placement proceeds or we provide care, additional privacy information and record-retention rules may apply to the person receiving support. Those operational care records are not fully described by this website policy.

3. Information we collect

Information you provide

The website enquiry form asks for full name, organisation or relationship to the client, phone number, email address, nature of enquiry and a message. We also receive information provided by email, telephone or other correspondence.

An enquiry may contain information about another person, including their care needs, mental or physical health, risk, disability, support arrangements or other sensitive circumstances. Only share information that you are authorised to provide and that is necessary for the initial enquiry.

Technical and website information

When someone visits the website, our hosting and analytics systems may process the requested page or file, referring page, browser type and version, operating system, device type, time of access and an IP address that IONOS states is anonymised for SiteAnalytics. Security and server logs may also be generated as part of hosting the website.

Information received from other people

A commissioner, referrer, relative, advocate or professional may contact us on behalf of another person. Where this happens, we may receive contact, referral and care-related information from that source. The person providing it should have a lawful reason and appropriate authority to do so.

4. Why we use personal information and our lawful bases

Responding to enquiries and considering placements

We use contact and enquiry information to respond, discuss suitability, arrange conversations or assessments and take steps requested before entering into an agreement. We rely on steps taken at your request before a contract and our legitimate interests in managing genuine service enquiries and communicating with referrers, families and professionals.

Health, social care and other sensitive information

Where it is necessary to process health or social care information, we rely on the applicable UK GDPR special-category condition for the provision or management of health or social care, together with applicable UK law and duties of confidentiality. In limited circumstances, another condition may apply, such as protecting vital interests, safeguarding, substantial public interest or explicit consent where consent is valid and appropriate.

Safeguarding, regulation and legal duties

We may use or disclose information where necessary to protect someone from harm, respond to a safeguarding concern, comply with care regulation, cooperate with lawful requests, establish or defend legal claims, or meet other legal obligations. The lawful basis will depend on the circumstances and may include legal obligation, vital interests or legitimate interests, with an appropriate special-category condition where required.

Operating and securing the website

We use technical information to deliver the website, maintain security, diagnose faults, prevent misuse and understand overall website performance. We rely on our legitimate interests in operating a safe, reliable and useful website.

Analytics

The website uses IONOS SiteAnalytics for statistical evaluation and technical optimisation. IONOS states that SiteAnalytics uses a pixel or log file, does not use cookies and anonymises the visitor's IP address directly after transmission. We use this information to understand overall website use and improve performance.

Direct marketing

We do not use placement enquiries or health information for unrelated direct marketing. If we introduce optional marketing communications, we will provide an appropriate choice and a simple way to opt out.

5. Cookies and similar technologies

IONOS states that SiteAnalytics does not use cookies. The website or its WordPress, form and consent-management components may use strictly necessary cookies or similar technologies for security, form operation or remembering privacy choices. These do not require consent where they are genuinely essential, but we still provide clear information about them.

If optional analytics, video, advertising or other non-essential technologies are added, they will be controlled through the website's cookie settings where consent is required. You can change your choice through the cookie settings made available on the website and can also manage cookies through your browser.

6. Who we share information with

We share personal information only where necessary and proportionate. Recipients may include authorised ARCH staff; IONOS and providers supporting our website, WordPress, Ninja Forms, IT and email; commissioners, local authorities, NHS bodies, care professionals and other organisations involved in a referral or placement; safeguarding bodies, the police, courts, regulators or public authorities where required or permitted; and professional advisers, auditors and insurers.

Service providers acting for us must process information under appropriate contractual and confidentiality requirements. We do not sell personal information.

7. International transfers

IONOS states that its web-hosting visitor data is not transferred to third countries outside the EU. Other service providers may process information outside the United Kingdom. Where a restricted transfer occurs, we use an available lawful mechanism, such as UK adequacy regulations or approved contractual safeguards, and apply additional protections where required. You can ask the privacy contact for information about relevant safeguards.

8. How long we keep information

If an enquiry does not lead to a placement or service, we propose to keep the enquiry and related correspondence for up to 12 months after the last meaningful contact, unless a safeguarding, complaint, legal or regulatory reason requires a different period.

If an enquiry leads to assessment, placement or care, relevant information becomes part of the appropriate referral or care record and is retained under our operational retention schedule and applicable legal, regulatory and professional requirements. Separate privacy information may apply.

IONOS states that web-hosting visitor data is stored for eight weeks and that SiteAnalytics reports remain available for analysis for the previous 12 months. Cookie-consent, complaint and legal records are retained only for as long as needed for the relevant purpose and accountability requirements.

9. Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. Access is limited to people who need the information for their role. No website or email system can be guaranteed completely secure, so please do not send detailed clinical records or other highly sensitive documents through the general website form.

10. Your data protection rights

Depending on the circumstances and the lawful basis, you may have the right to ask for access to your personal information, correction of inaccurate information, deletion, restriction, data portability, or withdrawal of consent. These rights are not absolute and may not apply to every record.

We may need to confirm identity before responding. We normally respond within one month, although the law allows more time for certain complex requests.

11. Complaints

Please contact us first so we can try to resolve a privacy concern. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

ICO website: https://ico.org.uk/make-a-complaint/

ICO telephone: 0303 123 1113

ICO address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Automated decision-making

We do not make decisions about placements or care using solely automated processing that produces legal or similarly significant effects. Suitability decisions involve human assessment and professional judgement.

13. Third-party links

The website may link to other organisations. Their privacy practices are governed by their own notices, and we are not responsible for how they process personal information.

14. Changes to this policy

We review this policy when our website, services, suppliers or legal requirements change. We will update the date at the top and, where a change is significant, bring it to the attention of affected people through an appropriate channel.