Privacy Policy

Note: This Privacy Notice has now been superseded, in part.  Where it references ‘employees’ please refer to the new Colleague Privacy Notice.

All references to ‘People We Support’ or ‘Clients’ remain the same until we replace this privacy notice very shortly with a new People We Support Privacy Notice.

Updated 25th February 2026

Applicable to:

• Employees and former employees
• Applicants
• Apprentices
• Peer mentors
• Student & professional placements
• Volunteers

1. Introduction 

Turning Point respects your privacy and is committed to protecting your personal data. This Privacy Notice will inform you about the type of personal data we collect and how we look after it.

This notice provides information about the use of personal information while you are a current or former employee, worker, consultant, officer, contractor, volunteer, casual worker, agency worker at Turning Point. If you fall into one of these categories, then you are a “data subject” for the purposes of this notice. As a member of staff (or equivalent) you also have certain legal and contractual responsibilities to protect the personal information of other people (e.g. other employees, students, research participants) by handling it appropriately.

This notice does not form part of any contract of employment or other contract to provide services.

Our responsibilities relating to data processing are set out the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018. In line with these provisions, data processing is overseen by our designated Data Protection Officer (DPO) whose principal duties are to inform, advise and monitor Turning Point’s compliance with the current data protection legislation.

2. Important information

It is important that you read this document together with any other privacy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you. This ensures that you are fully aware of how and why we are using your data.

3. Information about us and how to contact us

Turning Point is a leading social enterprise, designing and delivering health and social care services in the fields of substance use, mental health, learning disability, autism, acquired brain injury, sexual health, homelessness, healthy lifestyles, and employment.

Turning Point is the Data Controller for the data we hold about you. We hold your data to ensure we meet our contractual and statutory obligations and can operate in line with our approved policies and procedures.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions is relation to our privacy policies. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details below.

Full name of legal entity: Turning Point Ltd

Registered Office: America House 2 America Square, London EC3N 2LU  

Contact:  Data Protection Officer

Email address: [email protected]

Changes to the privacy notice and your duty to inform us of changes

This privacy notice is reviewed and updated as and when necessary. Links to previous notices can be found here.

Third Party Links

Accessing the Turning Point Internet site may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our site, we encourage you to read the privacy policy of every website you visit. Examples of third-party websites include Reed, Indeed and NHS (utilised for recruitment purposes).

4. Data Collection

4.1 What is Personal Data?

Personal data means any information that may be used to identify you on its own or when combined with other information, would enable your identification. Such personal data includes, but is not restricted to:

• Personal contact details: name, address, contact numbers, personal email addresses
• Date of Birth
• Gender
• Marital status
• Next of Kin and emergency contact information
• National Insurance Number
• Bank account details, payroll records ad tax information
• Salary, annual leave, pension and benefits information
• Start date
• Location of employment or workplace
• Identification documents: such as copy of your driving licence, passport and where relevant visa and right to work documentation
• Recruitment information: such as CV, application forms, DBS check, references and anything specifically required for your role
• Disciplinary or grievance details
• Details about your role: such as performance and development reviews, sickness records etc
• CCTV footage
• Information about how you use our information and communication systems
• Photographs
• Driving for work: such as driving licence number, insurance and MOT details

We may also hold the following information about you:

• Religion or other beliefs of a similar nature
• Family, lifestyle and/or social circumstances

Personal data does not include data where your identity has been removed and where you can no longer be identified (anonymised data). It is important that the personal information that we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

4.2 What is Special Category Data?

Turning Point will also process some information about you that is considered more sensitive and this is referred to as ‘special category’ personal data in the General Data Protection Regulation and Data Protection Act 2018. When we process this type of information we are required to apply additional protections.

 Special category personal data is defined as:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• health or sex life and sexual orientation
• genetic data
• biometric data which is processed to uniquely identify a person.

4.3 Criminal Convictions and Offences Data

Criminal convictions and offences data including enhanced DBS checks are processed by Turning Point in order to ensure that we are taking steps to safeguard the people we support and our colleagues.

4.4 Why do we process your data and what legal basis do we have to process your data?

We will only use your personal information when the law allows us to do so by providing us with a legal basis or valid condition. Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform the contract, we have entered into with you
• Where we need to comply with a legal obligation
• Where it is necessary for our legitimate interests (or those of a third party) and your interests or fundamental rights do not override those interests

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your vital interests (or someone else's interests).
• Where it is needed in the public interest or for official purposes.

We will only process information relating to criminal convictions if it is appropriate given the nature of the role and where it is in accordance with the law. This will usually be where such processing is necessary to carry out our legal obligations.

Less commonly, we may use information relating to criminal convictions where it is necessary for the establishment, exercise or defence of legal claims, where it is necessary to protect your interests (or someone else’s interests) and you cannot give your consent, or where you have already made the information public.

Your data is required to effectively:

• Recruit and appoint new staff
• Pay employees
• Manage your employment (including pension, tax and insurance obligations)
• Manage volunteer roles
• Support the management of self-employed staff
• Engage contractors
• Address any associated legal requirements.
• When you leave us, we will also process data to end our relationship.

In addition, key data may be used to:

• support our safeguarding
• manage risk responsibilities
• manage statutory obligations including:
  • incident reporting
  • professional body referral
  • Care Quality Commission [CQC] obligations
  • police referral processes
• Data is also used to underpin our employment monitoring requirements such as:
  • Case management processes (e.g., absence management)
  • Compile wider workforce information that informs organisational development
  • Workforce strategy and operational assurance.

Common law duty of confidentiality

Turning Point will respect and comply with our obligations under the common law duty of confidence.

We meet the duty of confidentiality under one of the following:

• You have provided us with your explicit consent.
• In circumstances where you would reasonably expect your data to be used, we rely on implied consent.
• We have approval from the Confidentiality Advisory Group (CAG).
• We have a legal requirement to collect, share and use the data.
• On a case-by-case basis, we will share information in the public interest.

4.5 How do we obtain your data?

Turning Point collects information about you during the recruitment/employment/volunteer/contracting (e.g., self-employed/contractor) cycle, where you provide us with your personal data in a number of ways.

During the recruitment stage, we will ask you to provide key information via our recruitment processes, such as:

• CV’s and applications that you will submit in either online or hard copy format. These are shared with the recruiting managers and recruitment teams only. Any hard copy paperwork will be processed by our recruitment/HR teams.
• Non-mandatory requirements (such as ethnicity information) are clearly identified and subsequently only provided with your consent. Such information is not shared with recruiting managers in any way, unless to comply with obligations such as the two-tick disability scheme (interview guaranteed provisions) or to facilitate the provision of reasonable adjustments.

During selection, we will ask you to provide additional information to meet regulatory requirements associated with the fit and proper persons / robust employment checking processes such as:

• Provision of reference details
• Paperwork to process Disclosure and Barring assessments (DBS)
• Eligibility to Work, including:
  • Passports
  • Utility bills
  • Driving license information
  • Residency permits, etc
• Professional registration
• Qualification checks
• Responsible officer details
• Indemnity insurance 
• We will also gather key information associated with interviews and assessments. 

As part of our appointment processes, we will ask you to provide information such as:

• Bank details
• Emergency contact details
• Registered contacts (pension related benefits)
• Indemnity insurance details.

These together with the information provided through the recruitment process will be shared with our HR teams. Information obtained via our employment checking processes will also be shared with your manager.

As well as directly recruiting staff, employees can enter into our organisation as a result of a transfer processes (TUPE). Data is shared with Turning Point from current employers (as part of the legislative requirement to provide employee information) and is also requested directly from the staff transferring. Likewise, Turning Point provides data to new providers of services, as required by transfer out processes (TUPE).

4.6 What do we do with your data?

Processing

All of the data gathered is processed to effectively recruit, appoint, and manage employment/volunteers, self-employed/contractor staff and associated legal requirements. Our lawful reasons for processing personal data routinely relate to:

• Performance of a contract or take steps to enter into that contract
• Protecting the vital interests of a data subject or another person
• Compliance with a legal obligation
• Legal defence
• Carrying out obligations under employment, social security / protection law or collective agreements
• Preventative or occupational medicine purposes

Our lawful reasons for processing special category data routinely relate to one of the above plus

• employment and social security and social protection law
• preventative or occupational medicine, capacity, medical diagnosis
• processing of criminal convictions data or referral to the DBS

There are exceptional occasions where we process data based on expressed consent (e.g. provision of ethnicity data). In these circumstances you can consent or withdraw consent at any time. Otherwise, we do not rely on consent as a legal basis for processing your personal data.

With the exception of our recognition platform (My Rewards) and insurance provisions (e.g. death in service benefits) we do not rely on legitimate interests as a lawful reason for processing.

To manage My Rewards, Turning Point provides limited personal data to our third-party provider (Caboodle).

To manage our insurance obligations, we will share both personal and special category data (relative to the insurance provision). For example, to manage death in service benefits we will share both personal and special category (e.g. absence) information.

The table at section 5 sets out a description of the ways we use your personal and special category data, and which legal basis we rely on to do so. We may process your data for more than one lawful ground, depending on the specific purpose for which we are using your data. Special Category Data and Criminal Records Data require both a lawful basis and an additional condition to be met for processing to be undertaken. These are addressed in sections 6 and 7, respectively.

Sharing your Data

Data is shared within the organisation as part of our lawful basis to process and is only shared relevant to the processing requirement. We will not share data with third parties unless there is a lawful/regulatory/legal/contractual or other legitimate requirement.

Examples of where we share such information in line with the above include:

• Complaint management
• Professional registration
• DBS referrals
• CQC obligations
• Safeguarding obligations
• TUPE transfer requirements
• Prevention and/or detection of crime
• Reference / status enquiries
• My Rewards
• Subject access requests

Examples of third parties include but are not restricted to: 

• NHS providers
• Occupational Health Providers
• Insurance companies
• Pension Providers
• Regulatory Authorities (e.g., Information Commission, GMC, RCMN, HCPC)
• CQC
• Trade Unions
• Mortgage providers
• Police
• Local Authorities
• External document management companies
• Solicitors
• Caboodle (My Rewards)
• ASC-WDS (Adult Social Care Workforce Data Set) to Skills for Care.
• Training providers
• Providers that mange travel and accommodation bookings

We do not transfer any of your personal data outside of the European Economic Area.

Storing your data

Your data is held securely in a number of ways:

• Our personnel, payroll, pension management and reporting system (and includes People Point - a manager/employee self-service platform).  Information generated from this is used to manage pay and generate a range of workforce reports
• Our risk management reporting system
• Our learning and development portal
• E-files – these are your personnel records which are stored centrally on a secure network
• Paper files – these are stored in secure storage at local, central, and off-site providers (i.e., off-site document management companies).
• Spreadsheet format – utilised for reporting and monitoring purposes, these documents are stored on our secure network.
• HR request and automated archiving files – these are queries managed via People Service Helpline.
• Applicant Tracking System – stores details of your application to Turning Point
• Teams
• Sharepoint
• Email
• Client Management Systems

Retaining your information     

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

As an example, this would be information relating to HRMC, PAYE and pay records may be kept for a minimum of 6 years after you leave our employment.

Further details on retention periods can be found in our “Records Retention Schedule”.

4.7 How do we secure your data?

We have appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents and other third parties that have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach and will notify you and the Information Commission of a breach where we are legally required to do so.

5. Purpose and Lawful Basis for which we will use your personal and special category data

Data Subject Rights: The following information is intended to help you understand you rights in relation to personal and special category data as provided by either the Data Protection Act 2018 or the UK GDPR.

The right to be informed

This relates to what information we are required to provide you about data processing. Turning Point Privacy policies represents the way in which we inform you.

Right of access

During the selection process and beyond you have the opportunity to access the information held (via subject access requests), update and amend data that changes or is incorrect (via employee self-service people point, as applicable) and where data has been given specifically under consent arrangements, withdraw that consent.

If you make a subject access request we will give you a description of the personal data we hold, why we hold it, who it could be disclosed to, let you have a copy of the information, enable you to correct any information.

We shall respond promptly (usually within 1 month from receiving all necessary information from you). This provision is usually free of charge; however, we retain the right to charge a reasonable fee if we believe a request is unfounded, excessive, or repetitive.

Further information can be found in our “Personal Information” document.

Right to rectification

You have the right to obtain from us, without undue delay, the rectification of inaccurate or incomplete personal data that we hold concerning you.

Right to erasure

You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing. We have the right to refuse to comply with a request for erasure and if this applies, we will tell you the reason why.

Right to restrict processing

Subject to exemptions, you have the right to restrict processing where:

• You contest the accuracy of the information we hold, and it is restricted until the accuracy is verified
• You have objected to processing (where it is necessary for the performance of a public interest task / legitimate interest) and we are considering whether our grounds override your rights
• Processing is unlawful and you oppose erasure, requesting restriction instead
• We no longer need the data, but you require the data to establish, exercise or defend a legal claim

Right to data portability

This applies when processing is carried out in an automated way. You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible, this right extends to us transmitting the data to another organisation at your request. For data portability to apply, the processing of your data must relate to information that is either i) based on consent or ii) processed for the performance of a contract.

Right to object

You have the right to object to processing on grounds relating to your personal circumstances. This provision applies to the processing that is undertaken for legitimate interests / the performance of a task in the public interests (includes personal profiling) and processing for purposes of scientific / historical research and statistics. In such cases we will stop processing unless we can demonstrate i) compelling legitimate grounds which override your interests, rights, and freedoms or ii) the processing is for the establishment, exercise, or defence of legal claims. This right extends to processing for the purposes of direct marketing (including profiling) which must be stopped outright.

Right not to be subject to decisions based solely on automated processing

Some processes involve automated tools, but decisions about you are always made by a person, not solely by automated means.

Invoking your rights: If you would like to invoke any of your rights, please contact:

Data Protection Officer
Turning Point
America House
2 America Square
LONDON
EC3N 2LU

Email: [email protected]

Complaints:

Please contact us if you wish to discuss how we have used your personal data, raise a data protection, administrative or clinical concern, or to make a complaint or compliment.

If you are unhappy with how we have used your data, you can then complain to the Information Commission.

If you wish to complain to the Information Commission, please visit https://ico.org.uk/global/contact-us or call the helpline on 0303 123 1113.