Privacy Policy
Last Updated: 24 July 2025
Live Well Kent & Medway (LWKM) is a partnership between Shaw Trust and Porchlight, funded by Kent County Council and NHS Kent and Medway. This Privacy Policy explains how we collect, use, and protect your personal data when you engage with our services or visit our website.
1. Who we are
Live Well Kent & Medway is commissioned by Kent County Council (KCC) and NHS Kent and Medway, and delivered by Shaw Trust and Porchlight. Shaw Trust and Porchlight are joint Data Controllers for the purposes of data protection legislation.
Contact Details
Shaw Trust – Data Protection Officer
Black Country House, Rounds Green Road, Oldbury B69 2DG
Email: data.protectionmailbox@shaw-trust.org.uk
2. What personal data we collect
We may collect the following types of personal information:
- Identity and contact data – name, date of birth, email, phone number, address, postcode
- Health and wellbeing information – mental or physical health data, support needs (where voluntarily provided)
- Referral data – how you accessed the service, referrer details
- Equality and diversity information – ethnicity, gender, religion, or sexual orientation (voluntary)
- Service interaction data – appointments, outcomes, support provided
- Technical data – IP address, browser type, device information, cookies (see Cookie Policy)
3. How we collect your data
We collect your data in the following ways:
- Directly from you – via forms, phone calls, web enquiries or in-person support
- From partner organisations – including GPs, NHS services, councils or referral agencies
- Through our website – using cookies and usage analytics
- From public sources – e.g. when fulfilling safeguarding obligations
Why we use data your data
We use your data to:
- Assess your needs and provide appropriate support
- Contact you regarding appointments or services
- Refer you (with your consent) to trusted support providers
- Monitor service quality and contract performance
- Comply with legal or safeguarding obligations
- Improve our services through anonymous analysis
5. Lawful basis for processing
We rely on one or more of the following UK GDPR bases:
- Consent – for marketing or voluntary services
- Public task – to deliver commissioned public services
- Contract – to deliver services you have signed up to
- Legitimate interest – to improve our services and site performance
- Legal obligation – e.g. safeguarding or regulatory reporting
- Substantial public interest – where we process special category data for health or equality monitoring
6. Who we share your data with
We may share your information with:
- Kent County Council and NHS Kent & Medway (service funders)
- Local partners delivering support
- Referral agencies (e.g. health, housing, employment)
- IT or CRM system providers (under contract)
- Regulators, safeguarding bodies, or legal authorities where required
We do not sell or rent your data to third parties.
7. How long we keep your data
We retain your data only for as long as needed:
- Support service data – up to 7 years from last contact
- Referral records – in line with our safeguarding and contractual obligations
- Cookies and website data – see Cookie Policy
After this, your data is securely deleted or anonymised.
8. How we protect your data
We take data security seriously. Measures include:
- Encrypted storage and secure servers
- Role-based access controls
- Staff training and policy compliance
- Data Protection Impact Assessments (DPIAs) for new systems or processes
- Contracts and vetting for all third-party suppliers
9. International transfers
Your data is primarily stored in the UK. If we use suppliers who process data outside the UK/EEA, we ensure appropriate safeguards (such as Standard Contractual Clauses or UK Addendum).
10. Your data protection rights
You have the right to:
- Access your personal data
- Correct inaccuracies
- Request deletion (in some cases)
- Restrict or object to certain processing
- Withdraw consent at any time (where consent is used)
- Request data portability
- Lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise your rights, email: data.protectionmailbox@shaw-trust.org.uk
To complain to the ICO: www.ico.org.uk