Privacy Policy

Controller: East Sussex, Brighton & Hove Registered Care Association (“ESPIC”)

Legal entity: Registered Care Association Ltd (ESPIC)

Registered office: Oakdown House, Burwash Common, Etchingham, TN19 7JR

Privacy queries: administrator@espic.co.uk

Company number: 09476471 (Companies House, UK)

Introduction

As part of the services we offer, we process personal data about our website visitors, members/applicants, and staff/contractors. “Processing” includes collecting, recording, organising, storing, sharing or deleting data.

We are committed to being transparent about why we need your personal data and what we do with it. This notice explains what we collect, our lawful bases, who we share it with, how long we keep it, your rights, and how to contact us.

Scope

This notice covers:

  • Use of our website (including contact forms, cookies and analytics, member login areas).

  • Membership applications/renewals and management (including Associate and Gold Membership via our membership system).

  • Staff and contractors engaged by ESPIC.

What data we collect

1) Website visitors

  • Technical data: IP address, device/browser, pages viewed, timestamps, referral sources, error logs.

  • Cookies & similar technologies: essential cookies for site operation; optional analytics/marketing cookies (only with consent). See our Cookie Notice for details and choices.

  • Contact/enquiry forms: name, email, phone, organisation, message content.

  • Accounts / members area: username, email, login history, roles/permissions.

2) Members & applicants (including Associate and Gold Membership)

  • Organisation & contact details: organisation name (as listed on CQC), service address(es), phone, email, registration/service types, Local Authority, other services operated, any notes you provide.

  • Applicant/signatory details: first name, last name, role/job title, declarations/confirmations, date.

  • Account & subscription data: chosen plan/tier, subscription status, invoices/receipts, renewal history, access to Gold Members area.

  • Payment data: payment status, transaction IDs, timestamps, amounts. (Processed by our payment provider; we do not store card numbers.)

  • Preferences/consents (optional): newsletters/updates; permission to share details with patrons/sponsors; directory listing preference.

3) Staff & contractors

  • Basic details and contact information: name, address, date of birth, National Insurance number, next of kin.

  • Financial details: bank/payment details, insurance, pension and tax details.

  • Employment/engagement records: contracts, training records, performance information.

  • Criminal records (where roles require it): unspent convictions/DBS results as permitted by law.

  • Special category data (only if necessary and lawful): e.g., sick pay/maternity information; demographic data only with explicit consent.

4) Sponsors and partners

We collect and process information provided by sponsors and partners for the purpose of delivering sponsorship activity and promoting relevant services to our members.

This may include:

  • Organisation details (company name, sector, website)

  • Contact details (named contacts, email addresses, phone numbers)

  • Company descriptions, product/service information, and marketing content

  • Details of any member benefits, discounts, or offers

Content submitted for publication (e.g. sponsor spotlight features, website profiles, event materials)

5) Event bookings and ticket sales

When you book a ticket for an ESPiC or BHPiC event (e.g. the Care Awards), we collect:

  • Booking details: name, email, phone number, organisation (where provided), ticket type, and any dietary or accessibility requirements you share with us.
  • Payment data: payment status, transaction IDs, timestamps and amounts. (Processed by our payment provider; we do not store card numbers.)

This data is collected and processed via our ticketing platform, Ticket Tailor, and our payment provider, Stripe.
We process this data under contract (to manage your booking and admit you to the event) and legitimate interests (event administration, safety, and catering/accessibility planning).

Ticket and attendee data is retained for up to 12 months after the event, unless a longer period is required for accounting purposes, after which it is deleted. If you are also a member, related billing records are retained per our membership retention policy above.

If you have consented to receive follow-up communications, we may contact you after the event about ESPiC/BHPiC membership or future events. You can withdraw this consent at any time by contacting administrator@espic.co.uk.

 

Where the data comes from

  • You / your organisation (forms, emails, phone, website, events).

  • Public sources (e.g., CQC register) to verify organisational details.

  • Our systems and services (website logs, membership system).

  • Payment provider (transaction confirmations).

Why we process your data (lawful bases)

We process personal data under one or more of the following lawful bases:

  • Contract – to process membership applications/renewals, provide member services, manage accounts, issue invoices/receipts, and administer access to the Gold Members area. To manage sponsorship agreements and deliver agreed benefits

  • Legitimate interests – website security/diagnostics; responding to enquiries; maintaining accurate records; governance/audit; preventing fraud and abuse; improving our services. To promote relevant services to our members and maintain accurate sponsor information across our website and communications

  • Legal obligation – accounting/tax records; safeguarding disclosures; responding to lawful requests from authorities.

  • Consent – sending newsletters/updates; sharing your contact details with patrons/sponsors; placing non-essential cookies/analytics. You can withdraw consent at any time.

For staff/contractors we also process data where necessary to comply with employment law and, where applicable, to perform tasks in the public interest. Criminal records checks are conducted only where legally justified (Data Protection Act 2018; Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975).

We do not intentionally collect special category data through membership forms. If you include such information in free-text fields, we will handle it appropriately and avoid retaining it unless necessary.

Data processing consent

In certain cases we rely on your explicit consent to process your personal data. This includes:

  • Sending marketing communications

  • Sharing your contact details with patrons/sponsors

  • Placing non-essential cookies

  • Administering membership applications through our website

Consent is collected through clear opt-in mechanisms (e.g., tick-boxes on registration forms). You can withdraw consent at any time by contacting administrator@espic.co.uk.

Who we share data with

We only share data when necessary for the purposes above:

  • Service providers (processors): secure website hosting/IT support; WordPress plugins and membership software (e.g., MemberPress); forms and email tools (e.g., Ninja Forms, MailPoet); analytics providers (if enabled); secure document/email services. Ticketing platform: Ticket Tailor, for processing event bookings and attendee data.

  • Payment provider: e.g., Stripe/PayPal — for processing payments. We receive transaction confirmations but not full card details.

  • Patrons/sponsors: only if you have given explicit consent for us to share your contact details for relevant offers or information. Sponsor organisation information may be published on our website, in newsletters, and in event-related materials as part of agreed sponsorship activity.

  • Public bodies/law enforcement: where required by law (e.g., safeguarding, court orders, tax authorities).

We do not sell your personal data.

International transfers

Some providers may process data outside the UK. Where transfers occur, we ensure appropriate safeguards are in place (e.g., UK adequacy regulations, International Data Transfer Agreement/Standard Contractual Clauses).

How long we keep your data (retention)

  • Website enquiries: typically up to 12 months after last contact (unless needed longer to handle a query/claim).

  • Membership/account & billing records: for the duration of membership and up to six (6) years after it ends (to meet accounting, tax and legal requirements).

  • Marketing/consent preferences: until you withdraw consent or your account is deleted.

  • Staff/contractor records: retained in line with statutory/employment guidelines and our internal retention schedule.

  • Server logs/security data: retained for a limited period for security, diagnostics and abuse prevention.

Security

We use secure hosting, TLS encryption in transit, access controls, least-privilege permissions, staff/admin training and regular updates/patching. Access to data is limited to those who need it to perform their role.

Your rights

You have the right to:

  • Access your data and receive a copy.

  • Rectify inaccurate or incomplete data.

  • Erase your data where it is no longer required and no legal basis requires retention.

  • Restrict or object to certain processing (including where based on legitimate interests).

  • Data portability (where processing is based on consent or contract and carried out by automated means).

  • Withdraw consent (for marketing, sponsor-sharing, and non-essential cookies) at any time.

We may need to verify your identity before responding. We aim to respond within one month. To exercise your rights, contact: administrator@espic.co.uk.

If you are unhappy with how we handle your data, you can complain to the UK regulator:
Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF • www.ico.org.uk

Children

Our site and membership services are directed at organisations and adults. If you believe a child has provided us with personal data without appropriate consent, please contact us so we can delete it.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Updates to this notice

We may update this notice from time to time. The latest version will always be available on our website. Significant changes will be highlighted on this page.

Last updated: July 2026