Privacy Policy

1. Introduction

Welcome to Nellie Supports' privacy notice. Nellie Supports respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you. This privacy notice is provided in a layered format so you can navigate to the specific areas set out below. Please also use the Glossary to understand the meaning of some of the terms used in this privacy notice.

2. Important information and who we are

Purpose of this privacy policy

This privacy notice aims to give you information on how Nellie Supports collects and processes your personal data through your use of this website, including any data you may provide when you contact us, sign up to our newsletter, or use our services. This website is not intended for children and we do not knowingly collect data relating to children. It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions so that you are fully aware of how and why we are using your data.

Controller

Nellie Supports is the controller and responsible for your personal data (referred to as "we", "us" or "our"). If you have any questions about this privacy notice or wish to exercise your legal rights, please contact us at nellie@nelliesupports.com.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection (www.ico.org.uk). We would, however, appreciate the opportunity to resolve your concerns first.

Changes to this privacy policy

We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please inform us if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites. We do not control these websites and are not responsible for their privacy statements. We encourage you to read their privacy notices.

3. The data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data, including:

• Identity Data: name, title, date of birth, gender
• Contact Data: address, email, phone numbers
• Financial Data: bank and payment details
• Transaction Data: details of services and payments
• Technical Data: IP address, browser, device, usage data
• Profile Data: preferences, feedback
• Usage Data: how you use our website and services
• Marketing and Communications Data

We may also collect Special Category Data, including health-related information, where necessary for service delivery. We do not collect data relating to criminal convictions and offences.

4. How is your personal data collected?

We collect data through direct interactions (forms, emails, calls), automated technologies (cookies, logs) and third parties, including analytics providers (for example Google), technical service providers and public records (for example the Electoral Register).

5. How we use your personal data

We will only use your personal data where lawful, including for the performance of a contract, our legitimate interests and legal obligations. The purposes for which we use your personal data include:

• Registering you as a service user (Identity, Contact; Contract)
• Processing payments (Identity, Contact, Financial, Transaction; Contract, Legitimate interests)
• Managing our relationship with you (Identity, Contact, Profile; Contract, Legal obligation)
• Administering our business and IT systems (Identity, Contact, Technical; Legitimate interests)
• Delivering website content (Identity, Technical, Usage; Legitimate interests)
• Improving services (Technical, Usage; Legitimate interests)
• Marketing recommendations (Identity, Contact, Profile; Legitimate interests)
• Using approved digital and AI-assisted tools to support spelling, grammar, clarity, formatting, consistency, administrative support and quality control (Identity, Contact, Profile, Special Category Data where relevant; Contract, Legitimate interests, Legal obligations, Article 9 conditions)

Use of AI-assisted tools

We may use approved AI-assisted tools to support spelling, grammar, clarity, formatting, consistency, administrative support and quality control in our work. We apply human review to all outputs, minimise personal data used, and do not use AI to make final professional decisions regarding mental capacity, care needs, safeguarding, diagnosis, best interests or legal conclusions.

6. Disclosures of your personal data

We may share your data with external third parties (see Glossary), business transfer partners, and service providers providing secure digital systems, AI tools, document management, IT, hosting and quality assurance.

Where we use AI-assisted tools, these are used only for limited administrative and quality assurance purposes such as grammar, formatting and consistency checks. We do not allow AI to make professional decisions and we ensure all outputs are reviewed by staff.

7. International transfers

Some service providers may process data outside the UK. We ensure safeguards are in place, including UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to SCCs, data processing agreements, and security measures and access controls. AI providers may process data internationally. We minimise data shared and restrict use to support functions only. Human professionals remain responsible for all final decisions.

8. Data security

We use appropriate security measures to prevent unauthorised access, loss or misuse. Access is limited to those with a business need. We have procedures to deal with data breaches.

9. Data retention

We retain personal data only as long as necessary, considering legal requirements, the nature and sensitivity of the data, and the purpose of processing.

10. Your legal rights

You have the right to access your data, correct your data, erase your data, object to processing, restrict processing, transfer your data and withdraw consent. Contact us to exercise these rights.

11. Glossary

External third parties: service providers providing IT, secure software, cloud hosting, AI tools, document management and digital support; contractors providing health and social care services; professional advisers (lawyers, auditors, insurers); HMRC and regulators.