GDPR & Data Protection Policy 
1. Introduction Solden Hill House is committed to protecting the privacy and personal data of the people we support, their families, our staff, professionals, partners and website users.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

2. Data Controller Solden Hill House acts as the Data Controller for all personal data processed in relation to our services.
All data is controlled and managed in-house, with strict access controls and governance procedures in place. 

3. How We Collect and Use Personal Data We collect and process personal data only where it is necessary and lawful to do so, including but not limited to:
Providing residential and supported living services
Meeting regulatory and safeguarding requirements
Employment and recruitment processes
Communicating with families, professionals and commissioners
Website enquiries and communications
Data is processed under lawful bases including legal obligation, contractual necessity, vital interests, and legitimate interests, depending on context. 

4. Data Security and Storage We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure. Digital data is stored on secure systems with restricted access
Physical records are stored securely
Archived information is held securely offsite
All archived information is securely stored with: Oasis (Box-IT)
South Midlands
Cottage Farm, Hartwell Road
Roade, Northamptonshire
NN7 2NU
Tel: 01604 861912 

5. IT Failure or Loss of Internet In the event of an IT failure, cyber incident or loss of internet connectivity, immediate contact should be made with our IT support provider: CYB3R
Tel: 0203 924 5555
Email: support@CYB3Rsolutions.com Headquarters:
CYB3R, 66 Hillgrove Business Park, Nazeing Road, Nazeing, EN9 2HB London Office:
CYB3R, 46 New Broad Street, London, EC2M 1JH Following this, internal escalation should take place as outlined below. 

6. Internal Escalation Contacts If further action or authorisation is required, please contact: Issy Sutthikhot, Registered Manager
Tel: 07907 730037
If Issy is unavailable, please contact: Sarah Swami, Chief Operating Officer
Tel: 07304 085697

7. Data Sharing Personal data is only shared where legally required or where it is necessary for the delivery of care and support. We do not sell personal data and only work with trusted partners who meet GDPR compliance standards. 

8. Data Retention Personal data is retained only for as long as necessary to meet legal, regulatory and operational requirements. Retention schedules are reviewed regularly. 

9. Individual Rights Individuals have rights under UK GDPR, including: The right to access their personal data
The right to rectification
The right to erasure (where applicable)
The right to restrict or object to processing
The right to data portability
Requests can be made in writing and will be responded to within statutory timeframes. 

10. Policy Review This policy is reviewed regularly and updated to reflect changes in legislation, guidance or operational practice.