Privacy Notice

Balance and Build Support Ltd. is committed to protecting your privacy and personal data. This notice explains how we collect, use, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice applies to individuals whose data we process in the course of our business operations, including our clients, suppliers, and employees.

1. Who We Are

Balance and Build Support Ltd is the Data Controller of your personal data. This means we are responsible for deciding how your data is processed and for what purposes.

Company: Balance and Build Support Ltd
Address: 2 Dulwich Road, Holland On Sea, CO15 5HR
Email: admin@balanceandbuildsupport.com
Website: www.balanceandbuildsupport.com

Our appointed Data Protection Officer (DPO) is responsible for overseeing questions regarding this privacy notice. If you have any questions, you can contact the DPO at the details above.

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data, which we have grouped together as follows:

Identity Data: First name, last name, title, date of birth.
Contact Data: Your address, email address, and telephone numbers.
Financial Data: Bank account and payment details necessary for billing and payments.
Technical Data: Internet Protocol (IP) address, login data, and device information when you interact with our systems.
Special Category Data: Depending on the nature of our service to you, we may also process more sensitive data, such as health information, in accordance with strict legal and contractual obligations.

3. How and Why We Use Your Personal Data

We will only use your personal data when the law allows us to. We have a legal basis for each processing activity.

Purpose: To provide services under a contract with a client (e.g., Suffolk County Council).
- Legal Basis: Performance of a contract. We need to process your data to fulfil our contractual obligations.
Purpose: To comply with a legal obligation, such as financial record-keeping.
- Legal Basis: Legal obligation.
Purpose: To communicate with you regarding our services and contracts.
- Legal Basis: Legitimate interests. We use your contact details to maintain an efficient working relationship.
Purpose: To provide you with specific support or care, which may involve special category data.
- Legal Basis: Explicit consent, or a reason of substantial public interest (as per our contract with a public body).

4. Data Sharing and International Transfers

We may share your data with third parties where necessary to fulfil our contractual obligations, comply with the law, or provide you with our services. This includes sharing data with:

Our clients, such as Local Authorities, as required by our contract.
Our IT service providers, including Google, for data storage and management.
Professional advisors such as auditors, lawyers, or accountants.

We ensure that all data transfers are secure. If data is ever transferred outside the UK or the European Economic Area (EEA), we use appropriate safeguards, such as Standard Contractual Clauses, to ensure the data is protected to the same high standards as it is in the UK.

5. Data Security

All data is stored securely in our Google Workspace environment. We have implemented technical and organisational measures, such as two-factor authentication and data encryption, to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. We limit access to your data to employees who have a business need to know, and all access is controlled and audited.

6. How Long We Keep Your Data

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Our data retention and destruction processes, managed through Google Vault, are detailed in our Data Protection Policy.

7. Your Legal Rights

Under data protection law, you have rights over your personal data, including the right to:

Request access to your personal data.
Request the correction of your personal data.
Request the erasure of your personal data (the 'right to be forgotten').
Object to the processing of your personal data.
Request the transfer of your personal data.

To exercise any of these rights, please contact our DPO using the details provided above. You also have the right to make a complaint to the Information Commissioner’s Office (ICO) at any time.

8. Changes to this Privacy Notice

We keep our privacy notice under regular review. This version was last updated on 13/08/25