Privacy Policy
This Privacy Policy applies to websites, systems and services operated by The Elm Collection Ltd (“we”, “us” or “our”), including Elm Homecare and Elm Residences. We are committed to protecting your privacy and handling personal data in accordance with the EU/EEA General Data Protection Regulation (GDPR) and Irish data protection law.
GDPR compliant
Transparent & fair
Security by design
1. Who we are (Data Controller)
The Elm Collection Ltd, Unit 1 Esmonde Court, Prosperous, Co. Kildare, W91 AVN9, Ireland.
Phone: (045) 493477 • Email: management@elmcollection.ie
This policy covers all services and websites for The Elm Collection, including Elm Homecare and Elm Residences.
2. What personal data we collect
Service users & representatives
- Identity & contact details (name, address, phone, email).
- Care information: assessments, plans, risks, preferences, notes, incidents.
- Health information relevant to providing care and supports (special category data).
- Next of kin, GP and other professionals’ details.
- Financial/ billing data (where applicable).
Staff & applicants
- Identity & contact details; work history; references.
- Garda Vetting and right‑to‑work documentation.
- Training records, supervision & rostering data (including geolocation from clock‑in app where required).
- Payroll and expense details.
Website & communications
- Enquiry forms, emails and phone recordings/notes.
- Technical data (IP address, device/browser), cookies (see Cookies section).
- CCTV in service users’ homes only where explicitly agreed under policy (see also “CCTV in a Service User’s Home” policy).
3. How we use personal data (purposes & legal bases)
Care & support provision
- Assess needs, plan and deliver person‑centred care; manage risk and safeguarding.
- Legal bases: performance of a contract; vital interests; legal obligation; public interest in the area of public health; explicit consent where required.
Governance & quality
- Supervision, audit, incident management, complaint handling, regulatory reporting.
- Legal bases: legal obligation; legitimate interests (quality improvement); substantial public interest for safeguarding.
HR & operations
- Recruitment, vetting, training, rostering, payroll, device/vehicle use for work.
- Legal bases: employment contract; legal obligation; legitimate interests (service continuity & safety).
Communications
- Responding to enquiries; service updates; out‑of‑hours coordination.
- Legal bases: contract; legitimate interests (customer service); consent for certain notifications where required.
4. Sharing & recipients
We share personal data only when necessary and lawful, for example with:
- Health and social care professionals (e.g., GPs, nurses, therapists) and the HSE.
- Regulators and authorities, where required by law (e.g., HIQA, Gardaí).
- Service providers under contract (e.g., IT systems, telephony, secure storage) subject to data processing agreements.
- Next of kin/representatives, where consented or necessary for vital interests.
We do not sell personal data.
5. International transfers
Where data is transferred outside the EEA (for example, via cloud providers), we use safeguards such as EU Standard Contractual Clauses and conduct risk assessments, ensuring an equivalent level of protection.
6. Retention
We retain personal data only as long as necessary for the purposes stated, and in line with legal and contractual requirements. Specific retention periods are set out in our internal retention schedule (available on request).
7. Your rights
Under GDPR you have the right to:
- Access your data and receive a copy.
- Rectify inaccuracies and complete incomplete data.
- Erase data in certain circumstances (“right to be forgotten”).
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time where processing is based on consent.
To exercise your rights, contact management@elmcollection.ie. We may need to verify your identity before fulfilling your request.
8. Cookies & tracking
Our websites may use essential cookies for security and functionality. Non‑essential analytics or advertising cookies (if used) will only run with your consent. You can manage cookies via your browser settings and (where implemented) our cookie banner.
9. Security
We implement appropriate technical and organisational measures, including access controls, encryption where appropriate, staff training, and incident response procedures. We review and test our controls regularly.
10. Children’s data
Where services involve children or young people, we handle their data with particular care and in line with our Child Safeguarding policy.
11. CCTV in a service user’s home
Where CCTV is requested in a service user’s home, we will assess necessity, obtain explicit consent (or other lawful basis), provide clear signage/notice, and follow our policy “CCTV in a Service User’s Home” including data minimisation, retention rules and access controls.
12. Complaints
If you have concerns about how we process your data, please contact us first at management@elmcollection.ie. You also have the right to lodge a complaint with the Data Protection Commission (DPC) in Ireland.
Visit the DPC’s website for contact details and guidance.
13. Changes to this policy
We may update this policy from time to time to reflect changes in law or our practices. We will post updates on this page and adjust the “Last updated” date below.
Last updated: 4 November 2025
Contact us
The Elm Collection Ltd
Unit 1 Esmonde Court, Prosperous, Co. Kildare, W91 AVN9
Phone: (045) 493477 • Email: management@elmcollection.ie
Out‑of‑hours line is for urgent care issues only and should not be used for privacy requests.