Ingeus UK are fully committed to ensuring that we are transparent about how we process your personal information. The processing of your personal information includes the collection, recording, storing, changing, sharing, general use, or destruction of your information
This Privacy Notice describes:
This Notice may be updated periodically, in line with changes to our processing or legislative updates. All changes will be published on our website.
The WHP NW supports individuals to find employment/begin self-employment and remain in work. The programme helps participants develop a personalised action plan and tailored package of ongoing support, and aims to support individuals to develop skills, gain confidence and improve their health and wellbeing.
This programme has been commissioned by the Department for Work & Pensions (DWP) and is part funded by the European Social Fund (ESF).
Ingeus UK Ltd is a company incorporated in England, registered at Companies House (04320853). In partnership with our Delivery Partners, Pluss, Halton Borough Council, Bootstrap and Inspire 2 Independence, we deliver the WHP NW Programme on behalf of Department for Work and Pensions (DWP).
We collect and use information obtained from yourself, DWP (including Jobcentre Plus (JCP)), and other referral organisations in order to provide the services described above.
By collecting information from you, Ingeus UK and our Delivery Partners can better identify your individual needs and how best to support you on the programme.
Ingeus UK Ltd process your information in order to provide you with the best possible support whilst on programme, as well as to meet the requirements of our contracts and other legal obligations. We cannot process your information without having a valid, lawful reason for doing so. Key reasons for processing your information are described below; further details about the organisations we share with and the legal basis for processing can be found here.
The aim of this programme is to assist you as best as possible during your progression on the programme. As such, we may work with other organisations to identify certain services that we think you could benefit from. By sharing information in this way, you do not have to provide the same information over again.
We routinely share your personal data with the following organisations to update them on your progress, including whether you have completed the programme, achieved any key milestones, left early, or provided you with additional support:
Ingeus UK cannot process your information without having a valid, lawful reason for doing so. For further details about the organisations we share with and the legal basis we have for sharing this data please click here.
Ingeus UK pride ourselves on continuously improving the services provided to you and others. We identify areas for improvement is by conducting research and evaluation of existing services. One way in which we do this is to convert your personal data into statistical or aggregated data, which is then used to produce statistical research and reports. This information is sometimes shared with the contract commissioner and other research organisations; however, it cannot be used to identify you.
We sometimes commission other organisations to carry out research on our behalf. Where your personal data can be identified or we would like you to provide additional information, via focus groups or feedback forms, we will always ask your permission first.
Where we need your agreement to process your information, for example, by passing your contact details to a third party, who is not a contracted Delivery Partner, we will ask you to provide your consent first. We will explain why your consent is needed and the information that we will share, this information with be provided verbally or via a consent form. Where verbal or written consent in provided this will be recorded on our systems for tracking purposes.
Where you have consented for us to share your information with a specific organisation or individual, you have the right to withdraw your consent at any time. Should you wish to withdraw your consent, please speak to your Keyworker who will update our records.
Ingeus UK is committed to protecting the confidentiality and security of your information. We ensure that your personal data is processed lawfully and respectfully, ensuring that we are always compliant with data protection laws and information security standards, for example, the General Data Protection Regulation (GDPR), Data Protection Act 2018, and ISO27001 (an information security standard). We have appropriate security measures in place to prevent personal data from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
All Ingeus UK staff are required to complete mandatory data protection and information security training to ensure they understand their responsibilities in relation to processing your personal information. Internal and external audits are also undertaken to ensure that data protection laws are being complied with.
Ingeus UK and our Delivery Partners are required to retain your information as part of our contractual and legal obligations. We will not retain your information for any longer than is necessary and where we are no longer required to keep your information, it will be safely and securely destroyed.
The following table provides you with information on how long we keep your information.
Type of Information
Length of time
|Your participant file||Until 2030|
|Information about convictions relating to serious sexual offences (MAPPA file)||Until the end of you time on the programme (15 months from the start date)|
|Information relating to fraud or any legal complaints you have made against us||For as long as we reasonably consider that you might legally bring an additional or repeat claim against us or to meet other statutory obligations|
|Financial information relating to payments we have made to you whilst on the programme||6 years following the end of the tax year|
The GDPR grants you certain rights in regards to your personal information, and the way in which it is processed. This gives you more control over what organisations are doing with your information. These rights are:
To find out more about how we use personal data we may ask you to prove your identity when making a request to exercise any of these rights. We do this to ensure we only disclose information where we know we are dealing with the right individual.
We aim to respond to all valid requests within one month. It may however take us longer if the request is particularly complicated or you have made several requests. We will always let you know if we think a response will take longer than one month.
We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.
Ingeus UK Ltd is committed to ensuring that you are always aware of what we are doing with your information and are kept abreast of any changes to the processing of your information. We do so through this Privacy Notice, which is reviewed and updated as and when required.
You have the right to ask for the personal information we hold about you. This is known as a Subject Access Request. However, while we will do our best to comply with your request, there may be circumstances where we are unable to fulfil your request, for example, where information we hold has been provided to us in confidence.
When requesting your personal information you will need to include the following information:
We endeavour to ensure that the information we hold about you is always accurate, however, there may be instances where the information we hold is no longer up to date. You can ask that we rectify any information about you that is incorrect. We would be happy to rectify such information but may need to verify the accuracy of the information first. Please speak to your Keyworker so that any inaccuracies can be investigated and corrected where necessary.
You have the right to request that certain personal information be erased from our systems if you feel that there is an underlying legal issue to us processing your information, or, where you withdraw consent.
While you may request for your information to be erased, this does not mean that we will be able to comply with your request, as there may be a legal reason that we have to keep your information. As such, each request is considered on a case-by-case basis.
You have the right to request us to ‘restrict’ the processing of your personal information, for example, if you are unsatisfied about the accuracy of the data and we undertake an investigation. We can continue to use your personal data following a request for restriction where we need to use it to establish, exercise or defend legal claims, or we need to use it to protect the rights of another individual or the company.
You have the right to request us to provide you with a copy of the personal information that you have provided to us, and which we process electronically. The data must be in a machine-readable format that facilitates transmission from controller-to-controller. This allows you further use of the data and enables you to move between service providers without any loss of data.
While you may request data portability, this does not mean that we will be able to comply with your request, as there may be reasons that we are unable to comply your request. As such, each request is considered on a case-by-case basis.
You have the right to object to us processing your personal information for the following reasons:
While you may object, this does not mean that we will be able to comply with your request, as there may be reasons that we are unable to comply, such as other legal obligations. Each request is considered on a case-by-case basis.
We do not carry out any automated decision making or profiling.
We do not transfer any of your data outside of the EEA.
If you wish to exercise any of the above rights please email or write to:
The Data Protection Officer, Ingeus UK Ltd, Second Floor, 66-68 East Smithfield, Royal Pharmaceutical Building, London, E1W 1AW
Ensure that you let us have enough information to identify you, e.g.name, address, date of birth, your adviser’s details and let us know the information which you request relates to.
Please contact our Data Protection Officer if you have any questions about this privacy notice or the information we hold about you.
If you have any concerns about in the way that your information is being processed, or feel your information is not being used appropriately, please raise your concerns with the Data Protection Officer, explaining what your specific concerns are. The Data Protection Officer will then investigate your concerns you have raised.
If you remain unsatisfied after the investigation by the Data Protection Officer and their response to you, you may raise a concern with the Information Commissioner