resilient roots
Care. Benefits. Coordination.
Privacy Notice (full version)
Version 1.0 · June 2026 · Resilient Roots Services Ltd · ICO registration ZC170832
| Company | Contact |
| Resilient Roots Services Ltd | Email: info@resilientroots.co.uk |
| Registered: 28a Grange Street, Clifton, Shefford, Bedfordshire, SG17 5EW | Telephone: [Telephone number to be added] |
| Company No: 17239772 | Website: resilientroots.co.uk |
| ICO Registration: ZC170832 |
- Important: Please Read This Notice
This Privacy Notice explains how Resilient Roots Services Ltd collects, uses, stores, shares, and protects your personal information. It applies to everyone who contacts us, uses our services, visits our website, or provides information to us in the course of our work.
We work with older people and their families, including people who may be vulnerable. Some of the information we collect about you or your family member is classified as special category data under UK law. This includes health information, disability information, and details of financial circumstances. We explain exactly what we collect and why in Section 3 below.
| If you have any questions about how we handle your information, please contact Victoria Patel, our Data Protection Lead, at info@resilientroots.co.uk before providing it. |
- Who We Are
Resilient Roots Services Ltd is a care navigation and benefits assistance service. We help families understand what older relatives are entitled to, assist with benefit applications, and coordinate practical care arrangements.
| Detail | Information |
| Company name | Resilient Roots Services Ltd |
| Registered address | 28a Grange Street, Clifton, Shefford, Bedfordshire, SG17 5EW |
| Company number | 17239772 |
| Data Controller | Resilient Roots Services Ltd |
| Named Data Protection Lead | Victoria Patel |
Resilient Roots Services Ltd · Company No. 17239772 · ICO ZC170832 · resilientroots.co.uk Page 1 of 7
| Detail | Information |
| Contact email | info@resilientroots.co.uk |
| Contact telephone | [Telephone number to be added] |
| Website | resilientroots.co.uk |
| ICO Registration Number | ZC170832 |
We are registered with the Information Commissioner’s Office (ICO) as a data controller. You can verify our registration at ico.org.uk using the registration number above.
- The Legal Framework
We process personal information in accordance with the following legislation: •
The UK General Data Protection Regulation (UK GDPR)
- The Data Protection Act 2018
- The Privacy and Electronic Communications Regulations 2003 (PECR), which governs cookies and electronic marketing
- The Care Act 2014, which places obligations on us regarding the safeguarding and welfare of vulnerable adults
- What Personal Information We Collect
4.1 Information about the adult child or family member engaging our service •
Your full name, contact telephone number, and email address
- Your home address, where relevant to service delivery
- Information about your caring responsibilities and your relationship to the older person •
Financial information where you are the payer for our services (payment details are processed securely; we do not store full card numbers)
- Correspondence with us, including emails and written notes from telephone calls and meetings
4.2 Information about the older person receiving the benefit of our service
| SPECIAL CATEGORY DATA: Health, disability, and mental capacity information is classified as special category personal data under Article 9 of the UK GDPR. This data receives the highest level of protection under the law. We only collect it where it is directly necessary to provide the service requested, and we only use it for that specific purpose. |
- Full name, date of birth, National Insurance number, and address
- Health conditions, medical history, diagnosis information, mobility and functional limitations, and medication details, where relevant to benefit eligibility or care arrangements
Resilient Roots Services Ltd · Company No. 17239772 · ICO ZC170832 · resilientroots.co.uk Page 2 of 7
- Mental capacity and cognitive function, where relevant to decisions about care or benefit applications
- Income, savings, pension details, and housing circumstances, where relevant to benefit eligibility
- Details of existing care arrangements, support services, and care providers
- GP details and any relevant NHS or social care referrals
- Information from existing benefit award letters, assessment reports, or care plans provided to us
- Records of any safeguarding concerns disclosed to us
4.3 Information collected through our website
- Your IP address and browser type
- Pages visited and time spent on the site
- Any information you submit via our contact form
We use cookies on our website. Our Cookie Policy explains this in full and is available at resilientroots.co.uk.
- Why We Collect It and Our Lawful Basis
The table below sets out the lawful basis and, where applicable, the special category condition for each type of processing we carry out.
| Purpose | Lawful basis (UK GDPR Art. 6) | Special category condition (Art. 9 and DPA 2018 Sch. 1) |
| Delivering the Navigate, Apply, or Coordinate service package you have purchased | Contract performance (Art. 6(1) (b)) | Explicit consent (Art. 9(2)(a)): obtained in writing via Schedule 1 of our Terms of Engagement before any health or financial data is collected |
| Completing benefit applications on your behalf (Attendance
Allowance, Pension Credit, Housing Benefit, Council Tax Reduction, Carer’s Allowance) |
Contract performance (Art. 6(1) (b)) | Explicit consent (Art. 9(2)(a)) and substantial public interest: social protection, DPA 2018
Schedule 1 Part 2 paragraph 6 |
| Care coordination: arranging home care, referrals, and support services | Contract performance (Art. 6(1) (b)) | Explicit consent (Art. 9(2)(a)) |
| Responding to enquiries before a contract is in place | Legitimate interests (Art. 6(1)(f)): responding to a direct enquiry is a legitimate interest that does not override your rights | Not applicable for general
enquiries; explicit consent obtained if health information is volunteered |
| Maintaining records of work done on your case | Legitimate interests (Art. 6(1)(f)): professional accountability and complaint resolution | Explicit consent (Art. 9(2)(a)) |
Resilient Roots Services Ltd · Company No. 17239772 · ICO ZC170832 · resilientroots.co.uk Page 3 of 7
| Purpose | Lawful basis (UK GDPR Art. 6) | Special category condition (Art. 9 and DPA 2018 Sch. 1) |
| Safeguarding: responding to a disclosure of abuse, neglect, or financial exploitation | Legal obligation (Art. 6(1)(c)): the Care Act 2014 and associated statutory guidance create a duty to refer concerns to the local authority | Substantial public interest:
safeguarding of individuals at risk, DPA 2018 Schedule 1 Part 2 paragraph 18 |
| Marketing: sending you
information about our services if you have opted in |
Consent (Art. 6(1)(a)): you can withdraw at any time | Not applicable |
| Website analytics | Legitimate interests (Art. 6(1)(f)), subject to consent for non
essential cookies under PECR |
Not applicable |
- Withdrawing Consent
Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time by contacting Victoria Patel at info@resilientroots.co.uk. We will stop processing the relevant information within five working days.
Please be aware that withdrawing consent for us to process health or financial information about an older person may mean we are unable to complete or continue the service. We will tell you what the practical effect will be before you make that decision.
- Who We Share Information With
We do not sell your personal information. We do not share it for marketing purposes. We only share it in the following circumstances:
| Recipient | Circumstances |
| Department for Work and Pensions (DWP) | When submitting benefit applications on your behalf, with your explicit consent |
| Your local authority’s adult social care team | When requesting a Care Act needs assessment or making a safeguarding referral; with your consent except where a safeguarding duty overrides this |
| Local authority housing or council tax departments | When submitting Housing Benefit or Council Tax Reduction applications, with your consent |
| NHS GP or other health
professionals |
Only where you have authorised us to liaise with them as part of care coordination |
| Private care providers | When arranging home care or support services under Package 3, with your consent |
| Our accountant, legal
advisers, or insurers |
Only where necessary for legitimate business purposes; bound by their own professional duties of confidentiality |
| ICO or other regulatory body | If required to do so by law or regulation |
Resilient Roots Services Ltd · Company No. 17239772 · ICO ZC170832 · resilientroots.co.uk Page 4 of 7
We do not transfer your personal information outside the United Kingdom. All data is stored and processed in the UK.
- How Long We Keep Your Information
| Type of record | Retention period |
| Client case files, benefit application records, and care coordination records | 7 years from the date of the last activity on your case (reflects the Limitation Act 1980 civil claims period) |
| Safeguarding records | 7 years from the date of the last entry, or longer if required by the relevant local authority |
| Financial records (invoices, payment records) | 6 years from the end of the relevant financial year (HMRC requirement) |
| Enquiries that did not become client engagements | 12 months from the date of last contact |
| Marketing consent records | Until consent is withdrawn, plus 2 years for audit purposes |
- How We Keep Your Information Secure
- Client records are stored in a password-protected, UK-based cloud storage system with access restricted to the three named founders
- Emails containing personal or health information are sent using encrypted connections where possible
- Physical documents are stored securely and are not left unattended
- We do not discuss client information in public places or on unsecured telephone calls •
All three founders have completed data protection awareness training
- In the event of a data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and notify you directly where the risk is high
- Your Rights
| Right | What it means in practice |
| Right to be
informed |
This Privacy Notice fulfils that right |
| Right of access | Request a copy of all personal information we hold about you. We will respond within one calendar month. |
| Right to rectification | Ask us to correct inaccurate information. We will do so within one calendar month. |
| Right to erasure | Ask us to delete your information. This right is not absolute; we may be unable to delete information required by law or for safeguarding purposes. |
| Right to restrict
processing |
Ask us to stop using your information in certain ways while a dispute is resolved |
Resilient Roots Services Ltd · Company No. 17239772 · ICO ZC170832 · resilientroots.co.uk Page 5 of 7
| Right | What it means in practice |
| Right to data
portability |
Where we process your information by automated means on the basis of consent or contract, ask us to provide it in a structured, machine-readable format |
| Right to object | Object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds. |
| Automated
decision-making |
We do not make decisions about you solely by automated means. All decisions are made by a named founder. |
To exercise any of these rights, contact Victoria Patel at info@resilientroots.co.uk or [Telephone number to be added]. We will not charge a fee for reasonable requests.
- Complaints
If you are unhappy with how we have handled your personal information, please contact us first. We will respond within five working days and aim to resolve the matter within 28 days.
If you remain dissatisfied, you have the right to complain to the ICO:
| ICO contact | Details |
| Website | ico.org.uk |
| Telephone | 0303 123 1113 |
| Post | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
- Safeguarding and This Notice
If you disclose information that suggests an older person may be at risk of harm, we may be required to share that information with your local authority’s adult safeguarding team, regardless of whether consent has been given. This is a legal obligation under the Care Act 2014 and takes precedence over our usual confidentiality obligations. We will always try to inform the person concerned that a referral is being made, unless doing so would put them at greater risk.
- Changes to This Notice
We review this Privacy Notice at least once a year and whenever there is a significant change to our services or the law. The version number and date in the footer confirm when it was last updated. If we make a material change, we will notify current clients directly.
- Contact Us
| How to reach us | Details |
| info@resilientroots.co.uk | |
| Telephone | [Telephone number to be added] |
| Post | 28a Grange Street, Clifton, Shefford, Bedfordshire, SG17 5EW |
Resilient Roots Services Ltd · Company No. 17239772 · ICO ZC170832 · resilientroots.co.uk Page 6 of 7
| How to reach us | Details |
| Data Protection Lead | Victoria Patel |
| Website | resilientroots.co.uk |
This Privacy Notice is prepared in accordance with UK GDPR (as retained and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), the Data Protection Act 2018, PECR 2003, and the Care Act 2014.
Resilient Roots Services Ltd · Privacy Notice · Version 1.0 · June 2026 · resilientroots.co.uk ·