Privacy notice – St Mary’s Kenmure

Last updated: 25 June 2026

St Mary’s Kenmure is committed to protecting the privacy and personal information of children and young people, families, carers, referrers, professionals, staff, applicants, visitors and people who contact us. We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable laws. The ICO says privacy information must be concise, transparent, easy to access and written in clear language, especially where children’s information is involved.

1. Who we are

St Mary’s Kenmure is a registered data controller.

Its ICO registration reference is Z5842986.

Contact details are:

St Mary’s Road,
Bishopbriggs,
Glasgow,
G64 2EH,

Telephone 0141 586 1200, and email administrator@stmaryskenmure.org.uk

St Mary’s Kenmure operates as a secure accommodation service for children and young people in Scotland.

2. How to contact us about data protection

If you have any questions about this privacy notice or how we handle your personal data, you can contact us at:

St Mary’s Kenmure
St Mary’s Road
Bishopbriggs
Glasgow
G64 2EH

Telephone: 0141 586 1200
Email: administrator@stmaryskenmure.org.uk

Data Protection Officer:

Any queries about how we process and use your data will be referred to our Data Protection Officer outsourced to Rachel Mitchell of RiSiO Solutions Ltd under contract.

Please use the same contact details:

St Mary’s Road,
Bishopbriggs,
Glasgow,
G64 2EH,

Telephone 0141 586 1200, and email administrator@stmaryskenmure.org.uk

3. Whose information we use

We may process personal information about:

  • children and young people in our care or being considered for referral;
  • parents, carers, guardians and family members involved in a child or young person’s support;
  • local authorities, partner agencies and other professionals making or supporting referrals; the website specifically states referrals can be made by phone or email.
  • people who contact us with enquiries;
  • job applicants, workers, volunteers and contractors;
  • website visitors.

4. The personal data we collect

Depending on your relationship with us, we may collect and use the following types of personal data:

a) Children and young people

Children and Young People can read our young person’s privacy notice here

  • name, date of birth, address, identifiers and contact details;
  • family, social and care background;
  • education, wellbeing, behavioural and support needs information;
  • safeguarding information, risk assessments and placement-related information;
  • health information and other special category data where this is necessary to provide care, support and protection;
  • information relating to incidents, interventions, reviews and outcomes.

Because St Mary’s Kenmure is a specialist secure care service for children and young people, it is reasonable that its processing includes sensitive and safeguarding-related information connected to care delivery and support.

b) Parents, carers and family members

  • names, contact details, relationship to the child or young person;
  • relevant welfare, safeguarding or contact information;
  • correspondence and records of meetings or communications.

c) Referrers and professionals

  • names, job titles, employer details, business contact details;
  • referral details, case information and related correspondence. The organisation provides a dedicated referral email address and referral phone number, referrals@stmaryskenmure.org.uk, 0141 586 1200.

d) Enquirers and website visitors

  • information you provide when contacting us by email or phone
  • technical information

e) Applicants, staff and volunteers

  • recruitment, vetting, employment and payroll records;
  • training, supervision, absence and performance information;
  • equality monitoring data where applicable.

5. How we collect personal data

We collect personal data:

  • directly from you when you contact us, apply for a role, visit us or otherwise provide information;
  • from local authorities, courts, partner agencies, health professionals, education providers, police, social work services or other referrers where they lawfully share information with us about a child or young person; secure accommodation referrals necessarily involve third-party referral routes and associated case information.

Cookies

Our website uses cookies to ensure it functions correctly and to remember your cookie preferences.

Cookies are small text files stored on your device when you visit a website. They help websites operate efficiently and, in some cases, improve your browsing experience.

We currently use only the following strictly necessary cookies:

  • CookieConsent – records your cookie consent preferences so that your choices are remembered when you return to the website.
  • wpEmojiSettingsSupports – a session cookie used by WordPress to determine whether your browser supports emoji display correctly, helping ensure website content is displayed as intended.

These cookies are essential for the operation of the website and do not require your consent under the Privacy and Electronic Communications Regulations (PECR).

If we introduce any non-essential cookies in the future, such as analytics or third-party functionality cookies, we will ask for your consent before they are placed on your device and will update both our Cookie Policy and this Privacy Notice accordingly.

For more detailed information about the cookies we use, including their purpose and duration, please refer to our Cookie Policy.

6. Why we use personal data and our lawful bases

We use personal data for the following purposes:

a) To receive and assess referrals

We use personal data to receive, review, assess and manage referrals, admissions, placements and transitions.  Our lawful basis is Article 6(1)(e) public task and/or Article 6(1)(c) legal obligation, depending on the exact role being carried out. Where special category data is involved, an additional condition under Article 9 will be required, such as substantial public interest, health or social care, or another relevant condition under the Data Protection Act 2018.

This will be documented in our Record of Processing Activities.

b) To provide care, support, safeguarding and wellbeing services

We use personal data to care for and support children and young people, protect their welfare, manage risks, deliver interventions and monitor outcomes. Given the nature of the service as secure accommodation for children and young people, processing includes sensitive data necessary for care and safety. The lawful basis is public task and/or legal obligation, with an additional Article 9 condition for special category data where required.

c) To communicate with parents, carers, referrers and professionals

We use personal data to liaise with families, local authorities and partner agencies, arrange meetings, respond to enquiries and coordinate support. The lawful basis is public task, legal obligation, or legitimate interests where that test is appropriate and consent.

d) To meet legal, regulatory, safeguarding and inspection obligations

We may use personal data to comply with legal duties, cooperate with regulators, respond to complaints, manage incidents, keep required records and demonstrate compliance. St Mary’s Kenmure is a registered service subject to external regulation and inspection.

e) To recruit and manage staff, volunteers and contractors

We process personal data for recruitment, vetting, employment administration, training and workforce management. The lawful basis may include contract, legal obligation, and, where relevant for special category data, the employment-related conditions under data protection law.

f) To manage our website, security and administration

We may process limited personal data to operate our website, keep systems secure, respond to messages and maintain records. Cookie policy

7. Special category and criminal offence data

Because of the nature of our services, we may process special category data such as health information, ethnicity, religion, safeguarding information and other information requiring extra protection, as well as information relating to criminal allegations, proceedings or safeguarding risks where the law allows it.

8. Who we share personal data with

We may share personal data where necessary, lawful and proportionate with:

  • local authorities and other placing authorities;
  • social work services and safeguarding partners;
  • education, health and wellbeing professionals;
  • regulators, inspectors and oversight bodies; St Mary’s Kenmure is regulated as a secure accommodation service and appears on the Care Inspectorate register.
  • police, courts or other competent authorities where required by law or to protect individuals;
  • professional advisers, auditors, insurers and IT or system suppliers who support our operations;
  • payroll, pensions, HR, recruitment or occupational health providers for workforce administration.

9. International transfers

We do not routinely transfer personal data outside the UK. If any of our systems or service providers transfer personal data internationally, we will only do so where appropriate safeguards are in place and we will provide details on request.

10. How long we keep personal data

We will only keep personal data for as long as necessary for the purpose for which it was collected, and in line with legal, regulatory, safeguarding, employment, financial and operational retention requirements.

  • referral and placement records: kept in line with statutory and sector retention requirements;
  • safeguarding and care-related records: kept in line with applicable legal and regulatory retention periods;
  • recruitment records: kept in line with employment and recruitment retention requirements;
  • general enquiries: retained only as long as necessary to respond and keep an appropriate business record;
  • website logs: retained in line with technical and security needs.

11. Your data protection rights

Under the UK GDPR, individuals may have rights to:

  • be informed about how their personal data is used;
  • request access to their personal data;
  • request correction of inaccurate personal data;
  • request erasure in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to processing in certain circumstances;
  • request data portability in certain circumstances;
  • withdraw consent at any time where consent is the lawful basis.

These rights are not absolute and may be limited in some situations, especially where we are required by law to keep or use information, or where exemptions apply.

To exercise any of your rights, please contact us using the details above.

12. Automated decision-making

We do not make solely automated decisions about individuals that have legal or similarly significant effects. If this changes, we will update this notice. The ICO says the existence of automated decision-making, including profiling, must be included where relevant.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at the details provided above in line with the requirements of the Data Use and Access Act 2025, so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s supervisory authority for data protection.

Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

14. Changes to this notice

We will update this privacy notice from time to time to reflect changes in our governance, services, legal requirements or how we process personal data.