Privacy notice
This notice explains how Heroic Care Ltd uses personal information connected with this website, job applications and the quality assurance survey.
Who is responsible and how to contact us
Heroic Care Ltd, company number 10004999, is the data controller. This means the company decides why and how this information is used.
Contact Lucy Hogg, Director and Data Protection Officer, about this notice or your information:
lucyhogg@heroiccare.com
01455 363121
Heroic Care Ltd, Stockwell House, New Buildings, Hinckley, Leicestershire, LE10 1HW.
Lucy is Heroic Care Ltd’s appointed Data Protection Officer. You can contact her about the use of your personal information or to exercise your data protection rights.
Job applications
We collect the information you enter in the application form, including your contact details, preferred role, employment history, qualifications, availability and reasons for applying. A CV and right-to-work share code are optional. We use this information to assess your application, contact you and arrange the recruitment process.
Required questions are marked with an asterisk. Without the relevant information we may be unable to assess your application. A share code is not required to submit an application. Any necessary right-to-work verification is a separate recruitment check.
Please do not send identity documents, National Insurance numbers, medical details or criminal-record information through this form or in your CV. If a relevant pre-employment check or an adjustment is needed, we will explain how to provide the necessary information separately.
Quality assurance survey
The survey collects your name, an optional email address, ratings and comments. We use responses to understand people’s experiences, follow up concerns and improve our service. The current survey requires a name and is not anonymous.
Please avoid including another person’s identifying details, medical information or other sensitive information unless it is necessary to explain a concern. Contact the team if you need a suitable way to discuss a confidential matter. Survey submission does not authorise public use of your name or comments as a testimonial.
Why we may use your information
The following lawful bases apply to the ordinary website activities described. Each basis is limited to its stated purpose. Our review of sensitive information and wider care and employment records is separate and remains to be completed.
| Purpose | Lawful basis |
|---|---|
| Process an application and take necessary steps towards an employment contract at the applicant’s request. | Article 6(1)(b): steps before entering a contract. |
| Carry out necessary statutory recruitment checks and maintain the records required by the applicable law. | Article 6(1)(c): legal obligation. For example, right-to-work requirements and applicable care-sector recruitment requirements. This is not a reason to collect unnecessary information early. |
| Keep a limited recruitment record to answer questions and establish or defend legal claims. | Article 6(1)(f): legitimate interests in a fair, accountable recruitment process and handling disputes. Subject to a documented necessity and balancing assessment. |
| Review ordinary survey responses, respond to people and improve service quality. | Article 6(1)(f): legitimate interests in understanding experiences and improving care. Subject to a documented necessity and balancing assessment. |
| Deliver and protect the website and forms against abuse. | Article 6(1)(f): legitimate interests in operating a secure, reliable service, with proportionate safeguards. |
| Load the optional Google map after you choose to allow it. | Article 6(1)(a): consent. You can change your choice using Cookie settings. |
Sensitive information
Health information and criminal-record information have additional legal requirements. Our internal access restrictions are a safeguard, but do not themselves establish a lawful basis. We have agreed to document the information collected, each specific purpose, the relevant legal conditions and safeguards, including any necessary legitimate-interests assessments.
Uses to verify include care delivery, safeguarding, complaints, recruitment adjustments and any separate recruitment checks. This assessment is not yet complete. Please contact Lucy to discuss the handling of a confidential matter, and avoid unnecessary health or criminal-record details in website submissions. The ordinary feedback basis above is not, on its own, a condition for using health information.
Who receives information
Job applications are emailed to lucyhogg@heroiccare.com and dan_hogg@hotmail.com. Survey responses are emailed to contact@heroiccare.com. These are the existing delivery arrangements.
Lucy Hogg and Dan Hogg receive the submissions. The company uses Microsoft 365 business accounts for its heroiccare.com mailboxes and Outlook to access email. Dan’s existing Hotmail address also receives applications. Within Heroic Care, access to sensitive information is restricted to upper management who have been vetted and authorised by the directors.
Cloudflare hosts and protects the website and supplies the Turnstile anti-spam check. Resend delivers form submissions, including any attached CV, to the receiving email accounts. The providers operating those email accounts also process and store the messages. Our website application does not maintain a separate submission database or publicly expose uploaded CVs.
Technical information such as IP addresses, browser information and security-check results is processed to operate and protect the site. Form answers are not written to the application’s own logs. This does not mean that email copies, delivery-provider records or infrastructure logs do not exist.
We have agreed to check and record the applicable provider terms, access settings, retention, backup arrangements and international-transfer safeguards. These checks are not yet complete. The separate Hotmail account will be assessed under its own arrangements, rather than assumed to be covered by the company’s Microsoft 365 agreement. Our review also includes documenting any necessary onward sharing with staff, relevant professionals, authorities or advisers.
Processing outside the UK
Some service providers process information outside the UK. Resend’s documentation states that message content and delivery data are stored in the United States. Its published data-processing agreement includes a UK transfer addendum. Cloudflare also operates internationally. Selecting a European email sending region does not, by itself, mean messages are stored in the UK or Europe.
Our account-specific provider and transfer review remains outstanding. Published provider terms do not by themselves establish that every required arrangement is in place for our accounts. Contact Lucy for the available information about transfers and safeguards, including how to obtain copies of relevant terms.
How long we keep information
Lucy Hogg and Dan Hogg will manage deletion and anonymisation under the approved periods below. Any longer retention must be necessary for a specific complaint, safeguarding matter, legal obligation or legal claim.
Approved retention periods:
- Unsuccessful applications: delete six months after the final recruitment decision. This covers the form, CV, duplicate emails and downloaded copies under our control.
- Identifiable survey responses: delete or genuinely anonymise within 12 months of receiving the response. Use anonymised summaries for longer-term quality trends only where individuals cannot reasonably be identified.
- Successful applicants: transfer only the necessary information to the personnel record. Staff-record retention is currently decided case by case. HR and Lucy will document separate periods or clear criteria, taking account of the purpose, applicable legal requirements and relevant care-sector or contractual requirements.
- Complaints, safeguarding matters and legal disputes: retain only the information necessary for that matter or a relevant legal hold. These records are currently reviewed case by case. We have agreed to record the reason for longer retention, the responsible person and the next review or disposal date, and to develop written periods or clear criteria for each record category. This work is not yet complete.
Existing staff, safeguarding and complaints records are held in written form by HR or in Lucy Hogg’s email inbox. The six- and 12-month periods apply to the specified website submissions, not automatically to all company records.
Lucy and Dan will manage deletion. We have agreed to establish a simple tracker and reminders to meet the approved deadlines and cover relevant emails, attachments, downloads and printed copies. Provider retention and backup arrangements also need checking. This practical process is still being established; publishing this notice does not automatically delete records.
Records should be reviewed earlier where they are no longer needed. Any longer retention needs a specific, documented reason and review date. These periods are company policy choices, not universal deadlines set by data protection law.
Photographs and personal stories
We hold signed image authorisations from parents and carers. We have agreed to review their scope and the authority of anyone signing for another person. Where an adult can make the decision, we will support their own informed choice. A parent or carer signing for someone else must have appropriate authority for that decision.
Our planned review will check public website use, accompanying names or personal information and an understandable withdrawal process. Permission for a photograph is not automatically permission to publish health information or a detailed personal story. This review is not yet complete. Contact Lucy if you have a question about an image or story identifying you, or wish to withdraw permission for a use based on your consent.
Your rights
Depending on the circumstances and lawful basis, you may ask to access, correct, erase or restrict use of your information, object to processing based on legitimate interests, or receive certain information in a portable form. These rights have conditions and exceptions. Where processing relies on consent, you can withdraw it; this does not affect processing that was lawful before withdrawal.
Contact Lucy using the details above. You may also complain to the Information Commissioner’s Office. You do not have to raise the matter with us first.
Cookies and choices
Read our cookies information. The optional embedded Google map stays unloaded unless you allow it. You can change that choice using Cookie settings in the footer.
Last updated: 9 October 2026. The retention periods and planned review actions described above were approved on this date. This notice will be updated as those actions are completed.