Privacy Notice

Balance and Build Support Ltd. is committed to protecting your privacy and personal data. This notice explains how we collect, use, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice applies to individuals whose data we process in the course of our business operations, including our clients, suppliers, supported individuals, and employees.

1. Who We Are

Balance and Build Support Ltd is the Data Controller of your personal data. This means we are responsible for deciding how your data is processed and for what purposes.

Company: Balance and Build Support Ltd
Address: 92 Station Road, Clacton on Sea, Essex, CO15 1SG
Email: admin@balanceandbuildsupport.com
Website: www.balanceandbuildsupport.com
Information Commissioner's Office (ICO) Registration: ZC011334

Our appointed Data Protection Officer (DPO) is Sharon Aldous, who is responsible for overseeing questions regarding this privacy notice. If you have any questions, you can contact the DPO using the details above.

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data, which we have grouped together as follows:

Identity Data: First name, last name, title, date of birth.
Contact Data: Your address, email address, and telephone numbers.
Financial Data: Bank account and payment details necessary for billing and payments.
Technical & Operational Data: Internet Protocol (IP) address, login data, and device information when you interact with our systems.
Special Category Data: Depending on the nature of our service to you (such as processing EHCP data), we may also process more sensitive data, such as health and educational information, in accordance with strict legal and contractual obligations.
Pseudonymised Data: We actively minimise personal data by using unique aliases within our operational applications to protect individual identities.

3. How and Why We Use Your Personal Data

We will only use your personal data when the law allows us to. We have a legal basis for each processing activity.

Purpose: To provide services under a contract with a client (e.g., Suffolk County Council).
- Legal Basis: Performance of a contract.
Purpose: To comply with a legal obligation, such as financial record-keeping.
- Legal Basis: Legal obligation.
Purpose: To communicate with you regarding our services and contracts.
- Legal Basis: Legitimate interests.
Purpose: To provide you with specific support or care, which may involve special category data (e.g., EHCP processing).
- Legal Basis: Explicit consent, or a reason of substantial public interest (as per our contract with a public body).

4. Data Sharing and International Transfers

We may share your data with third parties where strictly necessary to fulfil our contractual obligations, comply with the law, or provide you with our services. This includes sharing data with:

Our clients, such as Local Authorities (e.g., SCC), as required by our contract.
Our cloud infrastructure and IT service providers, primarily Google Workspace, for secure data storage and management.
Operational platform providers (e.g., AppSheet).
Professional advisors such as auditors, lawyers, or accountants.

Our data is securely hosted on cloud servers. If data is ever stored or processed outside the UK or the European Economic Area (EEA), it is legally justified and safeguarded by standard Data Processing Amendments, which include UK GDPR-compliant Standard Contractual Clauses (SCCs).

5. Data Security and Minimisation

We operate a highly secure, predominantly paperless environment. All digital data is stored securely in our Google Workspace environment. We have implemented rigorous technical and organisational measures, including:

Encryption & Access Control: Data is protected by multi-factor authentication and strict Role-Based Access Control (RBAC).
Data Minimisation (AI Processing): When processing highly sensitive documents, we utilise secure enterprise AI tools within our closed Google Workspace to summarise information and automatically strip out Personally Identifiable Information (PII).
Pseudonymisation: Across our operational platforms (including AppSheet and Base 44), all student and client records are strictly pseudonymised using aliases to ensure individuals cannot be identified without restricted identification keys.

6. How Long We Keep Your Data

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

Local Authority/SCC Data: Information relating to supported individuals is retained for the individual's Date of Birth + 25 years, in line with statutory requirements.
When data reaches the end of its retention period, it is permanently and securely purged from Google Vault and our operational systems, and recorded in our internal data destruction log.

7. Your Legal Rights

Under data protection law, you have rights over your personal data, including the right to:

Request access to your personal data.
Request the correction of your personal data.
Request the erasure of your personal data (the 'right to be forgotten').
Object to the processing of your personal data.
Request the transfer of your personal data.

To exercise any of these rights, please contact our DPO using the details provided above. You also have the right to make a complaint to the Information Commissioner’s Office (ICO) at any time.

8. Changes to this Privacy Notice

We keep our privacy notice under regular review to reflect our ongoing commitment to data security. This version was last updated on 11/05/2026