Privacy & Data Protection Policy
How Zento Group Limited collects, uses, shares and protects your personal information in line with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
This Privacy & Data Protection Policy explains how Zento Group Limited (“Zento”, “we”, “us” or “our”) collects, uses, shares and protects your personal information when you visit our website, contact us, enquire about our services, or use the care and support we provide. We are committed to protecting your privacy and handling your personal information lawfully, fairly and transparently, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Zento Group Limited is a private, nurse-led provider of care at home and housing support, registered with the Care Inspectorate in Scotland. For the purposes of data protection law, Zento is the “data controller” responsible for your personal information.
East High Street, Crieff PH7
Company Number: SC875709
Number: ZC198381
Who this policy applies to
This policy applies to visitors to our website, people who contact or enquire with us, prospective clients, the people we support (our clients / service users) and their families, representatives and carers.
Note for staff: Our employees, workers and job applicants are covered by a separate staff privacy notice, which is provided to them directly upon application or employment.
The personal information we collect
A. Information you give us
- Contact and enquiry details: your name, telephone number, email address, postal address, and details you provide when completing a form on our website, calling us, or emailing us.
- Care enquiry information: information about the care or support needed, which may include details concerning the health, routine, or personal circumstances of the individual requiring assistance.
B. Information about the people we support
Where you or a family member become a client, we collect the information we need to plan and deliver safe, person-centred care. This includes:
- • Contact details and emergency contacts / next of kin
- • GP and other medical/health professionals involved in your care
- • Funding and payment arrangements
- • Special category data: health and care needs, medical conditions, medication administration details, and any factors vital to keeping you safe and well
C. Information we collect automatically from our website
Technical and usage data: your IP address, browser type, device information, and how you interact with our website, gathered through cookies and related technologies in accordance with section 8.
Special category (sensitive) data
Delivering nurse-led care means we necessarily process “special category” data, in particular health and medical records. We only process this where the law allows — principally because it is necessary for the provision of health and social care and treatment (Article 9(2)(h) UK GDPR), for safeguarding, or, where required, with your explicit consent.
We handle all sensitive medical information with heightened confidentiality and restrict access strictly to team members who require it to provide care.
How we collect your information
We collect information through multiple channels:
- Directly from you via website forms, telephone calls, emails, and face-to-face consultations
- From family members, appointed guardians, or legal representatives
- From local authorities (such as Perth & Kinross Council and Lothian local authorities)
- From the NHS, GP surgeries, hospital discharge teams, social workers, and care professionals
Our lawful bases for using your information
Under UK data protection law, we must have a valid lawful basis for processing personal information. The main bases we rely on include:
| Purpose of Processing | Lawful Basis (UK GDPR) |
|---|---|
| Responding to your website enquiry or contact request | Legitimate interests / steps prior to entering a contract |
| Assessing care needs and providing care and support | Contract; provision of health and social care (Article 9(2)(h) special category) |
| Keeping people safe (safeguarding) | Legal obligation; vital interests; substantial public interest |
| Meeting regulatory and legal duties (Care Inspectorate, HMRC) | Legal obligation |
| Managing and improving our service, and quality assurance | Legitimate interests |
| Sending you marketing or updates (where relevant) | Consent |
| Website cookies and analytics | Consent (except strictly necessary cookies) |
How we use your information
- To respond to your enquiries and provide guidance on our care services.
- To assess care needs, draft personalised care plans, deliver care, review outcomes, and enhance quality.
- To safeguard the people we support and uphold adult protection requirements.
- To process funding, issue invoices, and manage client accounts and payments.
- To comply with legal, regulatory, and reporting obligations to the Care Inspectorate, the SSSC, and HMRC.
- To maintain accurate clinical and administrative records and conduct internal quality assurance.
* We will never subject your information to automated decision-making or profiling that produces legal or similarly significant effects.
Cookies
Our website uses cookies and similar technologies to ensure proper operation and to understand how visitors engage with our pages.
Strictly Necessary Cookies: Essential for site functionality, security, and accessibility. These remain active by default.
Analytics & Performance Cookies: Deployed only with your active consent through our cookie settings. You can manage or revoke your cookie preferences at any time.
Who we share your information with
We do not sell your personal information. We disclose data strictly on a need-to-know basis to parties bound by confidentiality and legal compliance:
- Health and social care partners: Local authorities (e.g. Perth & Kinross Council, Edinburgh City Council, Lothian Councils), NHS trusts, General Practitioners, district nurses, and assigned social workers.
- Regulators and statutory bodies: The Care Inspectorate, Scottish Social Services Council (SSSC), Disclosure Scotland, and HMRC.
- Contracted data processors: Secure IT infrastructure providers, accredited electronic care planning software, and payroll systems.
- Professional advisers: Legal counsel, auditors, and insurers when required.
Storing and transferring your information
We store personal data on secure, encrypted systems within the United Kingdom. Where third-party service providers process data outside the UK, we enforce strict legal safeguards (such as UK Adequacy Regulations or standard contractual clauses) to guarantee an equivalent degree of protection.
How long we keep your information
We retain your personal records only for as long as necessary to fulfil the purposes for which they were gathered, and to comply with health and social care regulatory, statutory accounting, and legal requirements.
Care and clinical records are stored according to Scottish health and social care retention schedules. Our full retention schedule is available on request.
Keeping your information secure
We deploy robust technical and organisational security measures to safeguard against loss, unauthorised disclosure, alteration, or unlawful access. Measures include role-based access restrictions, end-to-end encryption, regular staff data protection training, and documented data breach response procedures.
Your rights
Under data protection law, you possess key rights regarding your personal information:
How to complain
If you are unhappy about how we have handled your personal information, please contact our privacy lead first so we can work to put things right immediately.
The UK independent regulator for data protection:
For complaints regarding service delivery or care quality:
Changes to this policy
We may update this policy periodically to reflect evolving regulatory guidance or operational improvements. The latest version will always be published on this page, with the active revision date clearly stated.
Contact us
Zento Group Limited
East High Street, Crieff PH7
Have questions about your data?
Our data protection lead and nursing management team are here to help. Reach out directly with any privacy enquiries or requests.