Privacy Policy

Instream Partnership

Last updated: 13 September 2026

Instream Partnership respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how Instream Partnership collects, uses, stores and protects personal information when you use our website, contact us, use our services, apply for a position, work with us or otherwise provide information to us.

Instream Partnership provides support relating to Direct Payments, Individualised Budgets, Personal Health Budgets, Personal Assistants, employment support, payroll and funding management.

1. Who we are

Instream Partnership
1 Belfield Lane
Rochdale
OL16 3AY
Telephone: 01706 642 196
Mobile: 07950 107 307
Email: office@instream.org.uk
Website: www.instream.org.uk
Company number: 4713078

For privacy and data protection enquiries, please contact us using the details above.

2. Information we collect

Depending on how you interact with Instream Partnership, we may collect and process the following information:

Contact information

• Name
• Postal address
• Email address
• Telephone and mobile numbersContact preferences
• Information contained in correspondence with us

Client and support information

Where necessary to provide our services, we may collect information relating to:

• Disability and support requirements
• Health and medical information
• Care and support needs
• Personal circumstances
• Funding arrangements
• Direct Payments
• Personal Health Budgets
• Individualised Budgets
• Access to Work arrangements
• Personal Assistant requirements
• Information required to help manage support and funding

Some of this information is special category personal data, particularly information concerning health.

Employment and Personal Assistant information

If you apply to work with us or as a Personal Assistant, we may collect:

• Employment history
• Qualifications and training
• References
• Right-to-work information
• Contact details
• Payroll information
• Bank details where required for payment
• Information required for employment administration
• Relevant criminal-record information where legally permitted or required

Financial information

Where necessary to provide our services, we may process:

• Bank account information
• Payment information
• Funding information
• Budget information
• Payroll information
• Invoices and financial records
• Information relating to Direct Payments and other funding arrangements

We will only collect financial information where it is necessary for the service we provide.

Website information

When you use our website, we may collect:

• Your IP address
• Browser and device information
• Pages you visit
• Information about how you use our website
• Information submitted through contact or enquiry forms
• Cookie and similar technology information

3. How we use your information

We may use your personal information to:

• Provide our services
• Respond to enquiries
• Provide advice and support
• Assist with Direct Payments and other funding
• Assist with Personal Health Budgets and Individualised Budgets
• Assist with Personal Assistant recruitment
• Support employment and payroll administration
• Manage accounts and payments
• Communicate with clients, Personal Assistants and other relevant parties
• Arrange meetings, training and events
• Process applications for employment
• Maintain appropriate business and financial records
• Comply with legal and regulatory requirements
• Protect the rights, safety and wellbeing of individuals
• Improve our services and website
• Send information about our services where we are legally permitted to do so

We will only use personal information for purposes that are lawful, fair and transparent.

4. Our lawful bases for processing

Under UK GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract

We may process information where it is necessary to provide services under a contract or to take steps at your request before entering into a contract.

Legal obligation

We may process information where this is necessary for us to comply with a legal obligation, including obligations relating to employment, payroll, taxation, accounting and other regulatory requirements.

Legitimate interests

We may process information where it is necessary for our legitimate business interests, provided that those interests do not override your fundamental rights and freedoms.

Consent

Where required, we will ask for your consent before processing your information. Where processing is based on consent, you have the right to withdraw your consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Special category information

Some information we process may be considered special category data under UK GDPR. This can include information about health or disability.
We only process such information where there is a lawful basis under Article 6 of UK GDPR and an appropriate condition under Article 9 and/or the Data Protection Act 2018.

We take additional care when handling this information and seek to ensure that only information that is necessary for the relevant purpose is collected and used.

We do not use health or disability information for unrelated marketing purposes.

6. How we obtain information

We may receive personal information:

• Directly from you
• From your representative or authorised person
• From your Personal Assistant
• From an employer or prospective employer
• From a local authority
• From the NHS or other health or social care organisations where appropriate and lawful
• From organisations involved in funding or supporting your care
• From recruitment or employment processes
• Through our website
• Through telephone calls, emails, letters and other correspondence

Where we receive information from another organisation, we will handle it in accordance with applicable data protection law.

7. Sharing your information

We will not sell your personal information.

Where necessary and lawful, we may share information with organisations or individuals involved in providing or administering services to you.

This may include:

• Local authorities
• NHS organisations and healthcare professionals
• Funding bodies
• Government departments
• HM Revenue & Customs
• Pension providers
• Payroll and accounting providers
• Banks and payment providers
• Professional advisers
• IT and website service providers
• Recruitment and employment-related organisations
• Personal Assistants and employers where appropriate
• Regulators and law-enforcement authorities where legally required

We only share information where there is a lawful reason to do so and will seek to limit the information shared to what is necessary.

8. Personal Assistant information

In providing Personal Assistant recruitment and support services, we may process information about Personal Assistants and individuals seeking to employ Personal Assistants.

Where appropriate and lawful, relevant information may be shared between individuals seeking support and Personal Assistants to facilitate recruitment and employment.

We will take reasonable steps to ensure that information shared is appropriate for the purpose for which it is being provided.

9. Recruitment

If you apply for a job or Personal Assistant position through Instream Partnership, we will use the information you provide to assess your application and manage the recruitment process.

We may contact referees and carry out checks where appropriate and lawful.

If your application is unsuccessful, we will normally retain your information only for as long as necessary for recruitment administration, legal requirements and the handling of any potential disputes.

10. Payroll and financial information

Where Instream Partnership provides payroll or financial administration services, we may process information required to calculate and administer payments.

This may include names, addresses, bank details, tax information, National Insurance information, hours worked, rates of pay, deductions and other information required for payroll purposes.

We will only use this information for legitimate and appropriate purposes.

11. Website cookies

Our website uses cookies and similar technologies.
Cookies are small files placed on your device which can help a website function properly and provide information about how the website is used.
Some cookies may be essential for the operation of the website. Other cookies, such as analytics or tracking cookies, may require your consent.

Where consent is required, we will ask for it before placing non-essential cookies on your device.

You can control or delete cookies through your browser settings. However, disabling certain cookies may affect the functionality of the website.

You can view our cookie policy at https://www.instream.org.uk/cookie-policy-uk

12. Website analytics

We may use website analytics services to understand how visitors use our website, for example which pages are visited and how visitors interact with the website.

Where an analytics service uses non-essential cookies or similar tracking technologies, we will obtain consent where required by law.

13. Marketing

We may occasionally send information about our services, events, training or other relevant activities.

Where applicable, we will obtain consent for electronic direct marketing where required by law.

You can ask us to stop sending marketing communications at any time.
You can contact us using:

Email: office@instream.org.uk

We will not use sensitive health or disability information for direct marketing without an appropriate lawful basis and any additional consent required by law.

14. How long we keep your information

We will not keep personal information for longer than is necessary for the purpose for which it was collected.

The appropriate retention period will depend on the type of information and why we hold it.

Some records must be retained for longer periods because of legal, accounting, employment, tax, funding or regulatory requirements.

When information is no longer required, we will securely delete, destroy or anonymise it where appropriate.

15. Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against:

• Unauthorised access
• Accidental loss
• Theft
• Unauthorised alteration
• Unauthorised disclosure
• Destruction or damage

Access to personal information is restricted to people who need it for legitimate purposes.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

16. International transfers

Where we use third-party service providers that transfer personal information outside the United Kingdom, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place.

17. Your data protection rights

Under UK data protection law, you may have the right to:

• Ask for access to the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to erase your information in certain circumstances
• Ask us to restrict processing in certain circumstances
• Object to certain processing
• Request the transfer of certain information to another organisation
• Withdraw consent where processing is based on consent
• Object to direct marketing

These rights are subject to certain legal exceptions and may not apply in every situation.

18. Subject Access Requests

You have the right to ask us for a copy of the personal information we hold about you.

This is known as a Subject Access Request (SAR).

You can make a request by contacting:

Email: office@instream.org.uk

Post:
Data Protection
Instream Partnership
1 Belfield Lane
Rochdale
OL16 3AY

We may need to verify your identity before providing information.

19. Complaints

If you have concerns about how we have handled your personal information, please contact us first so that we can investigate your concerns.

You also have the right to complain to the Information Commissioner’s Office (ICO).

Information about making a complaint can be found on the ICO website.

20. Children’s information

Our services may involve individuals under the age of 18.

Where we process information relating to children, we will take appropriate care to ensure that the information is processed lawfully, fairly and securely, taking account of the child’s age and understanding where appropriate.

21. Third-party websites

Our website may contain links to other websites.

This Privacy Policy does not apply to websites operated by third parties.

We recommend that you read the privacy policy of any third-party website that you visit.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or the way we process personal information.

The latest version will be published on our website.

Last updated: 13 September 2026

23. Contact us

If you have any questions about this Privacy Policy or how Instream Partnership handles your personal information, please contact us.

Instream Partnership
1 Belfield Lane
Rochdale
OL16 3AY

Telephone: 01706 642 196
Mobile: 07950 107 307
Email: office@instream.org.uk
Website: www.instream.org.uk
Company number: 4713078