Privacy, GDPR &
Data Protection
Our Commitment to Privacy
At Kalo Living, we are committed to protecting the privacy and personal information of everyone we work with including children, families, staff, and professionals.
We handle all information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant Ofsted and safeguarding legislation.
We believe that privacy is not just a legal responsibility it’s a matter of respect and trust.
Who We Are
Kalo Living Ltd is the data controller responsible for the personal information collected and used by our organisation.
Registered Office:
Kalo Living, [Insert Address]
Email: info@kaloliving.co.uk
If you have any questions about how we handle data, please contact our Data Protection Lead at:
Email: dataprotection@kaloliving.co.uk
What Information We Collect
Depending on your relationship with us (child, parent, professional, employee, or applicant), we may collect and store the following types of information:
For children and young people:
- Personal details (name, age, gender, ethnicity, contact details).
- Health, education, and emotional wellbeing information.
- Care plans, risk assessments, and placement documentation.
- Behavioural, therapeutic, and progress records.
For parents, carers, and families:
- Contact details and relationship to the child.
- Records of visits, communication, and consent forms.
- Relevant information to support safe contact and family involvement.
For staff and applicants:
- Personal and employment details.
- Qualifications and training records.
- DBS and reference checks.
- Payroll, HR, and performance management information.
For professionals and agencies:
- Contact details for communication and collaboration.
- Reports and correspondence relevant to the child’s care.
We only collect information that is necessary, proportionate, and relevant to the services we provide.
How We Use Your Information
We use personal data to:
- Deliver safe and effective care to children and young people.
- Meet our legal and contractual responsibilities as a registered care provider.
- Communicate with parents, carers, and professionals.
- Manage staff employment, training, and wellbeing.
- Maintain compliance with Ofsted, safeguarding, and local authority requirements.
- Monitor, audit, and improve our services.
We will never use personal information for marketing or non-care-related purposes without explicit consent.
Lawful Basis for Processing
We process personal data under the following lawful bases:
- Legal obligation: to comply with children’s home regulations, safeguarding, and employment law.
- Public task: to carry out duties in the public interest (e.g. child protection).
- Contractual necessity: to fulfil employment or placement agreements.
- Vital interests: to protect someone’s life or wellbeing.
- Consent: when required for specific purposes (e.g. photos or testimonials).
How We Store and Protect Information
All personal data is stored securely in line with our Data Protection and IT Security Policy, using encrypted systems and restricted access.
We ensure that:
- Files are stored securely on password-protected systems.
- Paper records are kept in locked, access-controlled storage.
- Data is accessed only by authorised staff on a need-to-know basis.
- Information shared externally is encrypted and sent securely.
- Devices are protected by security software and regular audits.
We train all staff in data protection and confidentiality as part of their induction and refresher training.
Sharing Information
We only share information when it is necessary, lawful, and in the best interests of the child or person involved.
This may include sharing with:
- Local authorities, social workers, and placing teams.
- Ofsted and other regulatory bodies.
- Health, education, and therapeutic professionals.
- Emergency services, if required for safety reasons.
- Payroll or HR services for employment purposes.
Whenever possible, we will explain why information is being shared and seek consent unless doing so could place someone at risk.
How Long We Keep Information
We keep records only for as long as necessary, in line with statutory retention periods:
- Children’s care records: 75 years from date of birth (as required by regulation).
- Staff employment records: 6 years after employment ends.
- Financial records: 7 years.
- Recruitment applications (unsuccessful): 6 months.
Once data is no longer needed, it is securely deleted or destroyed.
Your Rights
Under data protection law, you have the right to:
- Access a copy of your personal information.
- Request correction of inaccurate data.
- Request deletion of information (where appropriate).
- Limit or object to processing.
- Withdraw consent for non-essential processing.
If you wish to exercise any of these rights, please contact our Data Protection Lead at:
Email: dataprotection@kaloliving.co.uk
We will respond to all data requests within one calendar month.
Your Right to Complain
If you are unhappy with how we handle your information, please contact us directly so we can address your concern.
If you remain dissatisfied, you have the right to contact:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Contact: 0303 123 1113
Website: www.ico.org.uk
Updates to This Policy
This Privacy Policy is reviewed annually or whenever there are changes to legislation or organisational processes.
The most up-to-date version will always be available on our website. Last updated: [Insert month, year]
A Final Word
“We treat your information with the same care, respect, and confidentiality that we give to the children and families we support because trust is the foundation of everything we do.”