Privacy Notice
Last updated: September 25, 2026
Carol’s Law Ltd respects your privacy and is committed to handling personal information carefully, lawfully and transparently.
This Privacy Notice explains what personal information we may collect, why we use it, how it may be shared, how long it may be retained and the rights available to individuals whose information we process.
Because our services may involve information relating to mental health, wellbeing, safeguarding and family circumstances, some of the information we receive may be sensitive and require additional protection.
Who We Are
Carol’s Law Ltd provides non-clinical family mental-health advocacy and referral support.
Organization: Carol’s Law Ltd
Registered office: 21 Metro House West Bromwich B70 9LB
Company number: 17442692
Privacy contact email: carolslawltd@gmail.com
What Personal Information We Collect
The information we collect depends on how you interact with Carol’s Law and the type of support or enquiry involved. We aim to collect only information that is relevant and necessary for the purpose concerned.
Contact and Identity Information
The information we collect depends on how you interact with Carol’s Law and the type of support or enquiry involved. We aim to collect only information that is relevant and necessary for the purpose concerned.
Information About the Person You Are Concerned About
Where you contact us regarding another person, we may receive information such as their name, age or date of birth, relationship to you and other details relevant to the concern being raised.
Mental Health, Wellbeing and Safety Information
Our work may involve information about mental health, behaviour, wellbeing, safeguarding concerns, risks, incidents, previous support and other sensitive circumstances.
Family and Case Information
This may include family observations, relevant history, timelines, previous attempts to obtain help, communications with services and information about the support being requested.
Professional and Service Information
We may receive or record information about GPs, NHS services, local authorities, social-care professionals, safeguarding teams or other organisations involved in the circumstances.
Documents and Supporting Information
Where relevant, you may provide documents, correspondence, records, screenshots, messages or other supporting information.
Communications With Carol’s Law
We may retain information contained in emails, telephone notes, contact forms, support requests and other communications with us.
Website and Technical Information
When you use our website, certain technical information may be collected automatically, such as device or browser information, IP address and information relating to cookies or similar technologies.
Sensitive information: Some information handled by Carol’s Law may include health information and other sensitive personal information. We recognise that this requires additional care and protection.
What Personal Information We Collect
We may collect personal information in several ways, depending on how you contact Carol’s Law and the support or service involved.
Information You Provide Directly
We may collect information when you complete a support request, contact form, questionnaire or other form, or when you communicate with us by email, telephone or another agreed method.
Information Provided by Family Members or Carers
Where a family member or carer contacts us about another person, they may provide relevant information about that person and the circumstances giving rise to the concern.
Information From Professionals or Services
Where appropriate and lawful, we may receive information from professionals, organisations or services involved in the circumstances, particularly where communication or referral support has been authorised.
Documents and Supporting Material
We may receive information through documents, records, correspondence, screenshots, messages or other supporting material provided as part of the agreed support.
Information Collected Through Our Website
Some technical information may be collected automatically when you use our website, including information associated with cookies, browser settings, device information and website usage.
We aim to collect information through appropriate channels and only to the extent relevant to the purpose for which it is needed.
How and Why We Use Personal Information
We use personal information only where it is relevant to the purpose for which it was collected and to support the operation of Carol’s Law and the services we provide.
To Respond to Enquiries
We use contact and enquiry information to respond to questions, provide information about our services and communicate with individuals who contact us.
To Assess Support Requests
We use information provided through our support process to understand the concerns being raised, consider whether Carol’s Law is an appropriate service and identify suitable next steps.
To Provide Advocacy and Referral Support
Where support is agreed, we may use relevant information to organize family concerns, prepare structured information, support referrals and assist with appropriate communication.
To Communicate With Professionals and Services
Where appropriate, authorised and necessary, we may use relevant information when communicating with professionals, organisations or services involved in the circumstances.
To Support Safeguarding
Information may be used where necessary to identify, consider or respond appropriately to safeguarding or serious safety concerns.
To Keep Appropriate Records
We maintain records of enquiries, support requests, communications, actions and outcomes where necessary for service delivery, accountability and administration.
To Manage Complaints and Feedback
We may use information to respond to complaints, concerns, compliments and other feedback about our services.
To Operate and Improve Our Website and Services
We may use appropriate technical and service information to maintain our website, monitor its operation and improve how our services are delivered.
To Meet Legal and Regulatory Responsibilities
We may process information where necessary to comply with applicable legal, regulatory, safeguarding, financial or organizational responsibilities.
We do not use sensitive family or mental-health information for unrelated marketing purposes.
Our Lawful Bases for Processing Personal Information
We only process personal information where we have an appropriate lawful basis under UK data protection law. The basis we rely on depends on why the information is being used and the circumstances in which it was obtained.
Contract
We may process information where this is necessary to provide an agreed service, take steps at your request before providing a service or manage our relationship with you.
Legitimate Interests
We may process information where this is necessary for our legitimate interests or those of another person, provided those interests are not overridden by the rights and interests of the individual concerned.
Legal Obligation
We may process information where this is necessary to comply with a legal obligation that applies to Carol’s Law.
Vital Interests
In limited circumstances, information may be processed where this is necessary to protect someone’s life.
Consent
Where consent is the appropriate lawful basis, we will seek consent that meets the applicable legal requirements. Where processing depends on consent, individuals may withdraw that consent, although this will not affect processing already carried out lawfully before withdrawal.
Special Category Information
Some information handled by Carol’s Law may include data concerning physical or mental health. Health information is treated as special category data under UK data protection law and receives additional protection. Reference
Where we process special category information, we must identify both an appropriate Article 6 lawful basis and a separate condition under Article 9 of the UK GDPR. Where required, additional conditions and safeguards under the Data Protection Act 2018 will also apply. Reference
Our approach: We identify and document the appropriate lawful basis and, where required, the relevant special-category condition before processing sensitive information.
Who We Share Personal Information With
We do not share personal information unnecessarily. Where information is shared, we aim to limit it to what is relevant and appropriate for the purpose concerned.
Health and Care Professionals
Where appropriate and authorised, relevant information may be shared with GPs, NHS services, mental-health professionals, social-care professionals or other services involved in the circumstances.
Local Authorities and Safeguarding Services
Information may be shared with local authorities, safeguarding teams or other appropriate bodies where this is relevant to the support being provided or where safeguarding responsibilities apply.
Other Relevant Organizations or Services
Depending on the circumstances, relevant information may be shared with other organisations involved in providing support, responding to concerns or carrying out appropriate professional responsibilities.
Service Providers
We may use trusted third-party providers to support the operation of our website, communications, document handling, administration or other business functions.
Professional Advisers
Information may be shared with appropriate professional advisers, such as legal, accounting or data-protection advisers, where necessary.
Legal or Regulatory Authorities
We may disclose information where required by law, regulation, court order or other lawful authority.
Safeguarding and serious safety concerns: There may be circumstances where information needs to be shared without the individual’s consent where this is lawful, necessary and appropriate to respond to a safeguarding concern, serious risk or other legal responsibility.
We aim to share the minimum amount of personal information necessary for the relevant purpose.
International Transfers and Third-Party Services
Some of the service providers we use may process or store personal information outside the United Kingdom.
Where personal information is transferred to a separate organization outside the UK and the UK international-transfer rules apply, we take appropriate steps to ensure that the transfer is lawful and that personal information continues to receive appropriate protection.
Depending on the circumstances, this may include relying on UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism permitted under UK data protection law.
Third-Party Services
Carol’s Law may use third-party technology and service providers for functions such as website hosting, forms, email, document storage and business administration.
These providers may process personal information on our behalf or, in some circumstances, for their own purposes. We take reasonable steps to understand the data-protection arrangements that apply to the services we use.
International transfers: Where a restricted transfer takes place, we will use an appropriate transfer mechanism where required under UK data protection law.
How Long We Keep Personal Information
We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, including where information needs to be retained for service delivery, safeguarding, legal, regulatory, accounting or record-keeping purposes.
The retention period will depend on the type of information, the reason it is held and any applicable legal or organisational requirements.
When deciding how long information should be retained, we may consider factors such as the nature and sensitivity of the information, the circumstances of the case, safeguarding considerations, whether an ongoing relationship exists and whether the information may be needed to establish, exercise or defend legal rights.
Retention Periods
Carol’s Law maintains appropriate retention arrangements for different categories of information, which may include:
General enquiries and correspondence
Support and case records
Consent and authorisation records
Referral and professional communication records
Safeguarding records
Complaints and feedback
Financial and transaction records
Website and technical records
When Information Is No Longer Required
When personal information is no longer required, we will take appropriate steps to securely delete, destroy or anonymize it, subject to any continuing legal, safeguarding or record-keeping requirements.
Retention periods may vary: Different types of records may need to be kept for different periods depending on their purpose and the circumstances involved.
How We Protect Personal Information
We take appropriate technical and organizational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Access Controls
Access to personal information is limited to those who need it for an appropriate business or service purpose.
Secure Systems and Services
We use appropriate systems and service providers to support the secure handling, storage and transmission of information.
Account and Device Security
Appropriate password, account and device-security measures are used to help protect access to systems containing personal information.
Information Sharing Controls
Personal information is shared only where appropriate and relevant to the purpose concerned, with consideration given to confidentiality, safeguarding and data-protection responsibilities.
Staff and Operational Procedures
Appropriate procedures are used to support the careful handling of personal information, including record management, confidentiality and incident response.
While we take reasonable steps to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure.
Security is kept under review: We may update our technical and organizational measures as our systems, services and risks change.
Your Data Protection Rights
Depending on the circumstances, you may have a number of rights in relation to your personal information under UK data protection law.
Right to Be Informed
You have the right to be told how and why your personal information is being used.
Right of Access
You may request access to personal information we hold about you and receive a copy of that information.
Right to Rectification
You may ask us to correct inaccurate personal information or complete information that is incomplete.
Right to Erasure
In certain circumstances, you may ask us to delete personal information we hold about you.
Right to Restrict Processing
In certain circumstances, you may ask us to limit how your personal information is used.
Right to Data Portability
Where this right applies, you may be entitled to receive certain personal information in a structured, commonly used and machine-readable format or request that it is transferred to another organization.
Right to Object
In certain circumstances, you may object to the processing of your personal information.
Rights Relating to Automated Decision-Making
You may have rights relating to decisions made solely by automated means, including certain forms of profiling.
How to Exercise Your Rights
To exercise a data-protection right, please contact us using the privacy contact details provided in this Privacy Notice. We may need to confirm your identity before responding to a request.
We will consider each request in accordance with applicable data-protection law and will explain if a right does not apply in the particular circumstances.
Please note: Data-protection rights are not always absolute. There may be circumstances in which information must be retained or processing may continue despite a request, for example where an applicable legal requirement or exemption applies.
Questions, Complaints and Contacting the ICO
If you have a question about how Carol’s Law handles personal information, or you believe your information has not been handled appropriately, please contact us using the privacy contact details in this notice.
Data Protection Complaints
You have the right to raise a complaint with Carol’s Law if you believe we have not handled personal information in accordance with data-protection law.
We will acknowledge receipt of a data-protection complaint within 30 days, investigate the concerns appropriately, keep you informed where necessary and provide an outcome without unjustifiable or excessive delay.
A data-protection complaint is separate from an ordinary service complaint or a request to exercise one of your data-protection rights, although the issues may sometimes overlap.
How to Contact Us
Email: carolslawltd@gmail.com
Postal address: 21 Metro House West Bromwich B70 9LB
Contacting the Information Commissioner’s Office
If you remain dissatisfied after giving Carol’s Law an opportunity to address your concerns, you may make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection.
Raising a concern with Carol’s Law does not affect your right to contact the ICO or seek any other remedy available to you under applicable law.
Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, systems, legal obligations or how we handle personal information.
When changes are made, we will update the “Last updated” date shown at the top of this notice. Where appropriate, we may also provide additional notice of significant changes.
If you have any questions about this Privacy Notice or how Carol’s Law handles personal information, please contact us using the privacy contact details provided above.
Last updated: September 25, 2026