Privacy Policy

Last updated: 11 September 2026

Eagles Nest Children’s Homes is committed to protecting the privacy, dignity and personal information of the children and young people we support, their families and representatives, professionals, employees, applicants, website visitors and everyone who communicates with us.

This Privacy Policy explains how we collect, use, store, share and protect personal information and the rights individuals have in relation to that information. We aim to handle personal information lawfully, fairly, securely and transparently and only use information where there is an appropriate reason for doing so.

This policy applies principally to information collected through this website, through enquiries and referrals, and through communications associated with Eagles Nest Children’s Homes. Children and young people living within our homes may also receive separate, age-appropriate privacy information explaining how their care records and other personal information are used.

Who We Are

Eagles Nest Children’s Homes is operated by Seven Steps Healthcare Limited. For the purposes of applicable UK data protection law, Seven Steps Healthcare Limited will normally act as the data controller for personal information that it determines how and why to use.

Our company details are:

• Company name: Seven Steps Healthcare Limited
• Company number: 09611063
• Registered office: 8 Highgate, Leicester, England, LE2 6SH
• Telephone: 0116 319 1600
• Website: Eagles Nest Children’s Homes

Questions about this Privacy Policy or the way we handle personal information can be directed to our Data Protection Lead using the contact details above or through our Contact Us page.

Data Protection Law

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018 and relevant amendments introduced by subsequent legislation, including the Data (Use and Access) Act 2025. Where electronic communications, cookies and similar technologies are used, we also take account of the Privacy and Electronic Communications Regulations 2003.

We are committed to applying the core data protection principles. Personal information should be processed lawfully, fairly and transparently, collected for specified and legitimate purposes, limited to what is necessary, kept accurate, retained only for as long as required and protected using appropriate security measures.

What Personal Information We May Collect

The personal information we collect depends on the reason an individual is interacting with us. We only seek information that is relevant and proportionate to the purpose for which it is required.

Information we may collect includes:

• names, titles and contact details, including telephone numbers and email addresses;
• professional details, job titles, organisations and local authority information;
• information provided through our website, enquiry forms, referral processes, telephone calls or correspondence;
• information about a child or young person who is being considered for or receiving a placement;
• date of birth, age, gender and identity information where relevant;
• family, relationship and important contact information;
• education and training information;
• health and wellbeing information;
• care plans, assessments and risk information;
• safeguarding information;
• behavioural, emotional and support needs;
• information concerning disabilities or additional needs;
• cultural, religious, linguistic and communication needs;
• information about professionals and agencies involved with a child;
• placement history where relevant to assessment and care planning;
• complaints, compliments, concerns and feedback;
• information supplied by job applicants, employees, workers and volunteers;
• technical information associated with use of our website, such as IP address, browser information, device information and website usage information where collected;
• information required for security, fraud prevention, legal compliance or the establishment, exercise or defence of legal claims.

Special Category Personal Information

Because Eagles Nest Children’s Homes provides residential children’s care, some of the information we receive may be particularly sensitive and classified as special category personal data under UK data protection law.

This may include information concerning:

• physical or mental health;
• disability;
• racial or ethnic origin;
• religious or philosophical beliefs;
• sexual orientation or sex life where genuinely relevant to care, safeguarding or wellbeing;
• biometric or genetic information where applicable and lawfully processed.

Special category information receives additional protection. We will only process this information where we have both an appropriate lawful basis for processing personal information generally and an additional legal condition permitting the processing of special category information.

Information About Children and Young People

Protecting children’s information is particularly important to us. Where we process information relating to a child or young person, we take account of their age, understanding, circumstances and vulnerability and apply additional care to the way their information is collected, accessed, shared and stored.

Where appropriate, children and young people are provided with information about how their personal information is used in a manner that is clear and appropriate to their age and understanding. We also support children to understand their information rights and how they can ask questions about the records held about them.

The privacy information provided on this website does not replace any more detailed or age-appropriate privacy information that may be provided directly to a child living within one of our homes.

Referral and Placement Information

When a local authority, social worker, commissioner or other authorised professional approaches us about a possible placement, we may receive personal information about the child before having any direct relationship with them.

This information may be necessary to assess whether we can safely and appropriately meet the child’s needs and whether the proposed placement is compatible with children already living within the home.

Referral information may include care plans, risk assessments, education information, health information, safeguarding information, relevant family circumstances, behaviour and emotional needs, contact arrangements, professional involvement and other information necessary to make a safe and informed placement decision.

We ask referring professionals to ensure that information shared with us is relevant, accurate, necessary and shared lawfully.

Where We Obtain Personal Information From

We may obtain personal information directly from the individual concerned or from another appropriate source.

Sources may include:

• children and young people;
• parents, carers and people with parental responsibility;
• local authorities and placing authorities;
• social workers and commissioners;
• education providers;
• health and social care professionals;
• police and safeguarding agencies;
• advocates and representatives;
• other organisations involved in a child’s care;
• employees, applicants, referees and recruitment organisations;
• individuals completing website forms or contacting us directly;
• our IT systems and website technologies;
• publicly available information where it is lawful and appropriate to use it.

How We Use Personal Information

We may use personal information for purposes including:

• responding to enquiries and requests for information;
• considering referrals and assessing placement suitability;
• providing residential care and support;
• developing, implementing and reviewing care plans and risk assessments;
• safeguarding children and other individuals;
• supporting health, education, wellbeing and positive outcomes;
• working with families, placing authorities and relevant professionals;
• maintaining records required by law and regulation;
• meeting our responsibilities as an Ofsted-registered provider;
• managing complaints, concerns, incidents and safeguarding matters;
• quality assurance, governance and service improvement;
• recruitment, employment and workforce management;
• maintaining website functionality and security;
• preventing fraud, misuse or unlawful activity;
• establishing, exercising or defending legal rights;
• complying with legal, regulatory and contractual requirements.

Our Lawful Bases for Processing

The lawful basis we rely upon will depend on the particular information and reason it is being used. We do not rely on consent where another lawful basis is more appropriate.

How We Process Special Category Information

Where we process special category personal information, we identify an additional condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.

Depending on the circumstances, these conditions may include processing that is necessary for:

• the provision or management of health or social care;
• safeguarding children or individuals at risk;
• reasons of substantial public interest where supported by law;
• protecting vital interests where the legal requirements are met;
• establishing, exercising or defending legal claims;
• processing based on explicit consent where that is genuinely appropriate.

Where required by law, we maintain appropriate supporting documentation setting out how sensitive personal information is protected.

Criminal Offence Information

In some circumstances we may need to process information relating to criminal allegations, convictions, offences, police involvement or safeguarding investigations.

We only process criminal offence information where it is necessary and lawful to do so and where an appropriate condition under UK data protection law applies. Access to such information is restricted to people who have a legitimate need to know it.

Safeguarding and Information Sharing

The safety and welfare of children is fundamental to our work. There may be circumstances in which we need to share personal information without consent in order to protect a child or another person from harm, comply with safeguarding duties, respond to an emergency, cooperate with an investigation or meet another legal obligation.

Where information is shared for safeguarding purposes, we aim to ensure that the information shared is relevant, necessary and proportionate to the circumstances and is provided only to appropriate people or organisations.

Who We May Share Personal Information With

We do not sell personal information. We may share information where necessary and lawful with organisations or individuals involved in delivering, regulating, supporting or overseeing our services.

Depending on the circumstances, these may include:

• placing authorities and other local authorities;
• social workers and commissioners;
• healthcare professionals and NHS services;
• schools, colleges and other education providers;
• Ofsted and other regulators or statutory bodies;
• police and safeguarding agencies;
• emergency services;
• independent advocates and relevant representatives;
• courts, tribunals and legal authorities;
• professional advisers, insurers and legal representatives;
• auditors and quality assurance professionals where appropriate;
• IT, hosting, communications and other service providers acting on our instructions;
• recruitment, training and employment service providers where relevant;
• other organisations where disclosure is required or permitted by law.

Where an external organisation processes personal information on our behalf, we require appropriate contractual and confidentiality arrangements and expect that information to be protected in accordance with applicable data protection law.

Information Sharing With Placing Authorities

A placing authority remains an important partner throughout a child’s placement. We may therefore share relevant information concerning a child’s care, progress, health, education, safeguarding, risks, significant events and outcomes with the placing authority and professionals responsible for reviewing the placement.

Information sharing is carried out according to the child’s circumstances, relevant legal requirements, care planning arrangements and the respective responsibilities of the organisations involved.

Keeping Personal Information Secure

We take the security of personal information seriously and use appropriate technical and organisational measures designed to protect information against accidental or unlawful loss, alteration, destruction, disclosure or unauthorised access.

Measures may include:

• access controls and role-based permissions;
• password protection and secure authentication;
• secure electronic systems and storage;
• physical security for paper records;
• secure disposal arrangements;
• staff confidentiality requirements;
• data protection and information governance training;
• appropriate contracts with service providers;
• backup and business continuity arrangements;
• procedures for identifying, reporting and managing personal data breaches.

Access to personal information is limited to those who reasonably require it for their role or another legitimate purpose.

How Long We Keep Personal Information

We do not keep personal information for longer than is necessary unless legislation, regulatory requirements, safeguarding considerations or another lawful reason requires us to retain it.

Retention periods depend on the nature of the information and the purposes for which it is held. We maintain retention arrangements designed to ensure information is securely deleted, destroyed or anonymised when it is no longer required.

Children’s case records maintained by a registered children’s home are subject to specific statutory requirements. In accordance with the Children’s Homes (England) Regulations 2015, a child’s case records are generally retained:

• for 75 years from the child’s date of birth; or
• where a child dies before reaching the age of 18, for 15 years from the date of the child’s death.

Other records that children’s homes are legally required to maintain may also be subject to specific minimum retention periods.

Website enquiries, professional correspondence, recruitment records, administrative information and other records are retained according to their purpose, applicable legal requirements and our organisational retention schedule.

International Transfers of Personal Information

Some organisations providing technology, hosting, communications or other services may process information outside the United Kingdom.

Where personal information is transferred to a separate organisation outside the UK and the transfer is subject to UK international data transfer rules, we take steps to ensure that an appropriate legal transfer mechanism is in place.

Depending on the destination and circumstances, this may include UK adequacy regulations, approved contractual safeguards such as the UK International Data Transfer Agreement or relevant Addendum, or another lawful transfer mechanism. Where required, we also assess whether the information will receive an appropriate standard of protection following the transfer.

Our Website and Technical Information

When someone visits our website, certain technical information may be generated automatically by the website, web server, hosting provider or security systems. This may include IP address, browser type, device type, operating system, pages visited, dates and times of access and technical security information.

We may use this information where necessary to operate and secure the website, investigate technical problems, prevent misuse and understand how the website is being used.

Cookies and Similar Technologies

Cookies are small pieces of information stored on or accessed from a user’s device when visiting a website. Some cookies are necessary for a website to operate properly, while others may be used for preferences, functionality, analytics or other purposes.

Strictly necessary cookies may be used where required for the operation, security or functionality of this website. Where non-essential cookies or similar technologies are used and consent is required, they should not be activated until the website visitor has made the appropriate choice through the website’s cookie controls.

Visitors can review and change available cookie preferences using the cookie controls provided on the website. Further information about specific cookies used should be available through our Cookie Policy or cookie settings tool.

Contact Forms and Email

When you contact us through a website form, telephone or email, we use the information you provide to respond to your enquiry and manage any subsequent communication.

Please only provide personal information that is necessary for the enquiry. Highly sensitive information concerning a child should not normally be submitted through a general website contact form unless we have specifically requested it and confirmed an appropriate method of transmission.

Recruitment Information

Where individuals apply for employment, work experience, volunteering or another position with us, we may collect information necessary to administer the recruitment process and assess suitability for the role.

This may include identity and contact information, employment history, qualifications, references, right-to-work information, interview information and other information relevant to safer recruitment.

Where a role involves working with children or vulnerable people, additional information and checks may be required in accordance with safeguarding and safer recruitment obligations, including information associated with Disclosure and Barring Service checks where legally appropriate.

Direct Marketing

We do not sell personal information for marketing purposes.

Where we send optional promotional or marketing communications, we will only do so where there is an appropriate lawful basis and where applicable electronic marketing requirements are met. Individuals may ask us to stop sending marketing communications at any time.

Service-related communications, safeguarding communications or information necessary for an existing professional relationship are not treated as optional marketing communications.

Links to Other Websites

Our website may contain links to websites operated by other organisations. We are not responsible for the privacy practices, security or content of external websites.

We encourage visitors to review the privacy information provided by any external website before submitting personal information to it.

Your Data Protection Rights

Depending on the circumstances and the lawful basis on which information is processed, individuals may have a number of rights under UK data protection law.

These may include:

• Right to be informed: the right to understand how and why personal information is being used.
• Right of access: the right to request confirmation of whether we hold personal information about you and, where applicable, obtain a copy of it.
• Right to rectification: the right to ask us to correct inaccurate information or complete information that is incomplete.
• Right to erasure: the right, in certain circumstances, to ask us to delete personal information.
• Right to restriction: the right, in certain circumstances, to ask us to restrict the way personal information is used.
• Right to data portability: the right, where applicable, to receive certain personal information in a structured and commonly used format or ask for it to be transferred to another organisation.
• Right to object: the right, in certain circumstances, to object to particular uses of personal information.
• Rights relating to automated decision-making: rights that may apply where decisions producing legal or similarly significant effects are made solely by automated means.
• Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time without affecting processing that was lawful before consent was withdrawn.

These rights are not absolute and may be limited in certain circumstances. For example, we may be legally required to retain particular children’s records even where an individual asks for them to be erased.

Accessing Children’s Records

A child or young person may have rights in relation to information held about them, including the right of access where they have sufficient understanding to exercise that right themselves.

Requests involving children’s records are considered carefully, taking account of the child’s rights, age and understanding, confidentiality, safeguarding obligations, information relating to other people and any applicable legal restrictions.

Parents or people with parental responsibility do not automatically have an unrestricted right to access every piece of personal information held about a child. Each request is considered according to the circumstances and applicable data protection and safeguarding requirements.

Making a Data Protection Request

If you wish to exercise a data protection right or ask a question about personal information we hold, please contact our Data Protection Lead.

We may need to confirm your identity before releasing personal information. This is intended to protect individuals against unauthorised disclosure.

We will respond within the applicable legal timescale and will let you know if additional time is lawfully required because of the nature or complexity of the request.

Automated Decision-Making and Profiling

Unless we tell you otherwise at the point personal information is collected, we do not use information collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects on an individual.

If this changes, we will provide appropriate information about the processing, the logic involved where required, the likely consequences and the rights available to affected individuals.

Personal Data Breaches

We maintain procedures for identifying, investigating, managing and recording suspected personal data breaches.

Where a breach creates a risk to individuals’ rights and freedoms, we will take appropriate action in accordance with applicable data protection legislation. This may include notifying the Information Commissioner’s Office and, where legally required, informing affected individuals.

Complaints About How We Use Personal Information

If you have concerns about how your personal information has been handled, we encourage you to contact us first so that we can investigate the matter and try to resolve your concerns.

You also have the right to raise a complaint with the Information Commissioner’s Office, which is the independent UK authority responsible for data protection regulation.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113

Changes to This Privacy Policy

We keep this Privacy Policy under review to ensure that it remains accurate and reflects our services, information-handling practices and legal obligations.

We may update the policy where our services change, where new technologies or systems are introduced or where data protection law, regulatory requirements or guidance changes.

The date shown at the beginning of this policy identifies when it was last updated. Where a change significantly affects how personal information is used, we will take reasonable steps to bring the change to the attention of affected individuals where required.

Contact Us About Privacy

If you have a question about this Privacy Policy, wish to exercise one of your information rights or have a concern about the way personal information is being handled, please contact:

Data Protection Lead
Seven Steps Healthcare Limited
8 Highgate
Leicester
England
LE2 6SH

Telephone: 0116 319 1600

You may also contact us through the Contact Us section of the Eagles Nest Children’s Homes website.