Privacy Policy for Route-Ways Solutions

Privacy Policy for Route-Ways Solutions Last Updated: 14th June 2025 

Route-Ways Solutions is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, and share your personal data when you use our services. 

1. Who We Are and Our Contact Details Route-Ways Solutions is a guidance and referrals provider dedicated to helping individuals find sustainable careers tailored to their needs. 

Data Controller: The data controller responsible for your personal data is Mr Peter Ridley. Trading Name: Route-Ways Solutions ICO Registration Number: ZB905967  Email Address: info@routeways.co.uk  

2. Information We Collect We may collect the following types of personal information: 

• Contact Details: Your name, email address, and phone number, which you provide when you interact with us. 
• Information from Questionnaires: Detailed information you provide about your health and well-being, skills, training, employment history, and support needs. This data helps us understand the support you require and is considered 'special category data' under data protection law due to its sensitive nature. 
• Support Session Information: Notes and progress made during your support sessions (e.g., starter 6 sessions, medium support 12 sessions, or extensive support 24 sessions). This may also include special category data related to your health and well-being as relevant to your support needs. 
• Action Plan Information: Details of your agreed action plan and your route to employment, which we develop collaboratively with you. 
• Technical Data: Information about how you access and use our website and services, such as your Internet Protocol (IP) address, browser type and version, operating system, unique device identifiers, and how you interact with our website. This data helps us improve our website and ensure its security. 

3. How We Use Your Information and Our Lawful Basis for Processing We use your personal information for the following purposes, based on the specified lawful bases under UK GDPR: 

• To assess your support needs through our initial questionnaire:  
• Lawful Basis (General Data): Legitimate Interests (to understand your needs and tailor our services effectively). 
• Lawful Basis (Special Category Data - e.g., health information): Explicit Consent (obtained from you at the point of collection for specific purposes) and/or Substantial Public Interest (where necessary for employment, social security, or social protection purposes, in line with relevant UK law). 
• To develop a tailored action plan and your route to employment:  
• Lawful Basis (General Data): Performance of a Contract (to deliver the services you have requested from us) and/or Legitimate Interests. 
• Lawful Basis (Special Category Data): Explicit Consent and/or Substantial Public Interest. 
• To provide you with guidance and support during your sessions:  
• Lawful Basis (General Data): Performance of a Contract and/or Legitimate Interests. 
• Lawful Basis (Special Category Data): Explicit Consent and/or Substantial Public Interest. 
• To make referrals to our partner organisations (health and well-being providers, skills/training providers, professional qualification providers, employers):  
• Lawful Basis (General & Special Category Data): Explicit Consent. We will specifically seek and obtain your explicit consent before sharing your personal data, especially any special category data, with any partner organisation for referral purposes. You will have control over which partners your data is shared with. 
• To communicate with you about our services and relevant opportunities:  
• Lawful Basis: Legitimate Interests (for service-related communications, e.g., updates on your support plan, appointment reminders). For marketing communications (e.g., newsletters about new services or opportunities), we will rely on your Consent. 
• To comply with legal obligations, such as record-keeping and regulatory requirements:  
• Lawful Basis: Legal Obligation (e.g., responding to lawful requests from authorities, maintaining necessary business records). 
• For internal record keeping, administration, and to improve our services:  
• Lawful Basis: Legitimate Interests (to manage our business effectively, identify areas for service improvement, and ensure operational efficiency). 

4. Sharing Your Information We may share your personal information with the following categories of recipients: 

• Partner Organisations: With your explicit consent, we may share relevant information, including sensitive personal data, with our partner health and well-being providers, skills, training, and professional qualification providers, and employers to facilitate referrals and support your journey to sustainable employment. Your consent will be specifically obtained before any such sharing occurs. 
• IQMS Learning: If you choose to book training courses recommended by us and provided by IQMS Learning, we may share necessary contact details to facilitate this referral. Please note that all bookings and the delivery of these courses are managed solely by IQMS Learning, and their privacy policy will apply to the information you provide directly to them. We will obtain your consent before sharing your details with IQMS Learning for this purpose. 
• Service Providers (Processors): We may use carefully selected third-party service providers who process data on our behalf for specific functions (e.g., IT support, website hosting, email services, customer relationship management (CRM) systems). These providers are considered "processors" under UK GDPR. We have contracts in place with them that obligate them to protect your data, implement appropriate security measures, and only process data strictly according to our instructions and the law. We only use providers who can demonstrate their commitment to data protection. 
• Legal Requirements: We may disclose your personal information if required to do so by law or in response to a valid legal request from a public authority (e.g., a court order, law enforcement request, or regulatory body). 

5. Your Rights Under UK data protection law, you have certain rights regarding your personal data. To exercise any of these rights, please contact us at info@routeways.co.uk. We will respond to your request within one month, which may be extended by two further months in complex cases. 

• The right to be informed: You have the right to be informed about the collection and use of your personal data. This Privacy Policy serves to fulfil that right. 
• The right of access: You can request a copy of the personal information we hold about you. This is commonly known as a Subject Access Request (SAR). 
• The right to rectification: You can ask us to correct any inaccurate or incomplete personal information we hold about you. 
• The right to erasure ('the right to be forgotten'): In certain circumstances, you can request that we delete your personal information, for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and there is no other lawful basis for us to continue processing it. 
• The right to restrict processing: You can ask us to limit how we use your personal information in certain situations, for example, if you believe the data is inaccurate, or if you object to our processing, while we verify our legitimate grounds. 
• The right to data portability: You can request to receive your personal information in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller, where technically feasible. This right applies to data processed by automated means where the lawful basis is consent or contract. 
• The right to object: You can object to the processing of your personal information in certain circumstances, particularly where we are relying on legitimate interests as our lawful basis, or for direct marketing purposes. 
• Rights in relation to automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for entering into, or performance of, a contract; is authorised by law; or is based on your explicit consent. Route-Ways Solutions does not currently engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals. 
• The right to withdraw consent: Where we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. 

Making a Complaint to the ICO: You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority set up to uphold information rights. ICO website: www.ico.org.uk ICO helpline: 0303 123 1113 Before contacting the ICO, we encourage you to contact us directly so we can try to resolve your concern. 

6. Data Security We take reasonable and appropriate technical and organisational measures to protect your personal information from unauthorised access, use, disclosure, alteration, or destruction. These measures include, but are not limited to, encryption, access controls, regular security assessments, and staff training on data protection. 

7. Data Retention We will keep your personal information for as long as necessary to fulfil the purposes for which it was collected, including for the duration of your support and any necessary period thereafter for legal, accounting, or administrative reasons. 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements. For example, client support notes may be retained for a period of 7 years after your last session to meet professional indemnity insurance requirements or regulatory obligations. 

8. International Data Transfers (If Applicable) If we transfer your personal data outside the UK (e.g., if we use cloud service providers whose servers are located outside the UK or European Economic Area (EEA)), we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: 

• We will only transfer your personal data to countries that have been deemed by the UK government to provide an adequate level of protection for personal data (e.g., countries subject to adequacy regulations). 
• Where we use certain service providers, we may use specific contracts approved by the UK government which give personal data the same protection it has in the UK (e.g., International Data Transfer Agreements (IDTA) or International Data Transfer Addendum to the European Commission's Standard Contractual Clauses). 
• Where we use providers based in the US, we may transfer data to them if they are part of a recognised framework, such as the UK Extension to the EU-US Data Privacy Framework, which requires them to provide similar protection to personal data shared between the UK and the US. 

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK. 

9. Links to Other Websites Our website may contain links to other websites, such as IQMS Learning. This Privacy Policy only applies to Route-Ways Solutions. When you link to other websites, you should read their own privacy policies. We are not responsible for the privacy practices or content of these third-party websites. 

10. Changes to Our Privacy Policy We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" revision date. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. For significant changes, we may notify you by email or through a prominent notice on our website. 

11. Contact Us If you have any questions about this Privacy Policy or our data practices, please contact us at: Email: info@routeways.co.uk