Our approach

We process personal data lawfully, fairly and transparently, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We collect only what we need for each purpose (data minimisation), keep it accurate and secure, and keep it no longer than necessary.

Controller and processor

For our own staff, applicants and enquiries, UK Instant Services Ltd is the controller. On client contracts we agree the roles in writing: where we process personal data on your instructions – for example service-user records on a care contract or visitor records on an FM contract – we act as your processor under a data processing agreement that meets Article 28 of UK GDPR.

Lawful bases for vetting

We process staff vetting data to meet legal obligations (such as right to work checks) and to take steps towards and perform employment and subcontract agreements. DBS checks and other criminal-offence data are only requested where the role is eligible, and are handled under the conditions in Schedule 1 of the Data Protection Act 2018, with access limited to the people who need it.

Health and care information

Care records contain special category (health) data. We process it to provide health and social care (UK GDPR Article 9(2)(h)) and follow the Caldicott Principles: justify the purpose, use it only when necessary, use the minimum needed, give access on a strict need-to-know basis, make sure everyone understands their responsibilities, comply with the law, share it when it is in the person's interest, and inform people how their information is used.

Confidentiality and training

Every employee and subcontractor agrees to confidentiality terms and completes data protection training as part of onboarding, with refreshers.

Security in Ronove

Role-based permissions: each office role is given no access, view, edit or full access to each part of the system, and app features are switched on or off for staff, clients and families.
Audit trail: an activity log records who changed what, and when.
Passwords are stored as one-way hashes, never in plain text.
Encryption in transit: our websites and apps are served over HTTPS.

Retention and secure deletion

We keep records for set periods according to our retention schedule and your contract, then delete or anonymise them securely. At the end of a contract we return or delete client data as the contract requires.

Your rights

People can ask to access, correct or delete their information, restrict or object to its use, or ask for a copy. We respond within one month. Requests about data we process for a client are passed to that client promptly.

Breach management

We record and investigate every suspected personal data breach. Where required, we report it to the ICO within 72 hours, and we notify affected clients without undue delay so they can meet their own obligations.

Subcontractors and processors

We carry out due diligence on subcontractors and suppliers who handle personal data, and put written terms in place before they do.

Freedom of Information

We support public sector clients with Freedom of Information and Environmental Information requests about our contracts, providing information promptly and flagging anything commercially sensitive.

Contact

For any data protection matter, email contact@ukis.io or write to UK Instant Services Ltd, 25 Church Gate, Leicester LE1 3AL. You can also contact the Information Commissioner's Office.

GDPR & information governance