PRIVACY POLICY
Jurisdiction: Scotland / United Kingdom
Last Updated 28 May 2026
1. Who We Are
This Privacy Policy is issued by Tenlu Group Limited, a company registered in Scotland, trading as Two Good Friends (“we”, “us”, “our”). We provide care at home and housing support services and are registered with the Care Inspectorate (registration number SP2025000222).
We are a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Registered office: Clydebank, Scotland
Contact: contact@twogoodfriends.co.uk
2. What This Policy Covers
This policy explains what personal data we collect, how we use it, the legal basis on which we process it, how long we retain it, and your rights as a data subject. It applies to:
• visitors to our website (twogoodfriends.co.uk);
• individuals who contact us by email, telephone, or enquiry form;
• service users, their families, and representatives;
• prospective and current employees, volunteers, and contractors.
3. The Personal Data We Collect
3.1 Website Visitors
When you visit our website, our hosting provider (Squarespace) may automatically collect certain technical data, including your IP address, browser type, pages visited, and the date and time of your visit. This data is collected for security and performance purposes and is not used by us to identify you personally.
3.2 Individuals Who Contact Us
When you contact us directly, whether by email, telephone, or any enquiry form we introduce in the future, we may collect:
• your name and contact details (email address, telephone number, postal address);
• the nature of your enquiry or the circumstances you describe;
• any other personal information you choose to share with us.
3.3 Service Users
In the course of providing care at home or housing support services, we collect and process more detailed personal and, where relevant, special category data. This includes:
• identity and contact information;
• health and medical information (special category data under UK GDPR Article 9);
• care needs assessments and support plans;
• records of services delivered;
• financial information relevant to funding or self-directed support arrangements;
• next-of-kin and emergency contact details.
We process special category data on the basis of Article 9(2)(h) UK GDPR (health or social care purposes), in conjunction with Schedule 1, Part 1 of the Data Protection Act 2018.
3.4 Staff, Volunteers, and Contractors
We collect and process personal data about individuals working with us, including identity documents, right-to-work checks, PVG Scheme records, references, and employment or engagement records. A separate Staff Privacy Notice is provided at the point of engagement.
4. Legal Bases for Processing
We only process personal data where we have a lawful basis to do so. The bases we rely upon are:
• Contract (Article 6(1)(b) UK GDPR): where processing is necessary to deliver the services you have engaged us to provide, or to take steps at your request prior to entering into a contract.
• Legal obligation (Article 6(1)(c) UK GDPR): where processing is required to comply with our obligations under health and social care legislation, employment law, or regulatory requirements imposed by the Care Inspectorate.
• Vital interests (Article 6(1)(d) UK GDPR): where processing is necessary to protect the life of a service user or another person.
• Legitimate interests (Article 6(1)(f) UK GDPR): for limited purposes such as maintaining the security of our systems, managing our business operations, and responding to enquiries. We carry out a balancing assessment to ensure our interests do not override your rights.
• Explicit consent (Article 6(1)(a) / Article 9(2)(a) UK GDPR): where we ask for your consent and you provide it freely. You may withdraw consent at any time without detriment.
5. How We Use Your Personal Data
We use the personal data we collect for the following purposes:
• to respond to enquiries and provide information about our services;
• to deliver, manage, and review care at home and housing support services;
• to comply with our regulatory and legal obligations, including Care Inspectorate registration requirements;
• to safeguard service users and, where necessary, to share information with statutory agencies;
• to manage employment and contractor relationships;
• to maintain the security and integrity of our systems and website;
• to improve our services and meet quality assurance standards.
We will not use your personal data for direct marketing without your express consent.
6. Sharing Your Personal Data
We do not sell, rent, or trade personal data. We may share data in the following limited circumstances:
• with statutory bodies, including local authority Health and Social Care Partnerships (West Dunbartonshire HSCP and East Dunbartonshire HSCP), where we are commissioned to deliver services or where disclosure is required by law;
• with the Care Inspectorate, in the exercise of its regulatory functions;
• with healthcare professionals involved in the care of a service user, where sharing is necessary and proportionate;
• with our IT service providers and platforms (including Squarespace), who process data only on our behalf and under contractual data processing agreements;
• with professional advisers (solicitors, accountants, insurers) bound by duties of confidentiality;
• with law enforcement or other authorities, where required or permitted by law.
Where we share data with third parties, we take reasonable steps to ensure those parties handle it in accordance with UK GDPR.
7. International Transfers
Some of our service providers, including Squarespace, may process data outside the United Kingdom. Where this occurs, we take steps to ensure that appropriate safeguards are in place, including reliance on the UK adequacy regulations or standard contractual clauses approved by the Information Commissioner's Office (ICO).
8. Data Retention
We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law or regulatory guidance. In general:
• Enquiry and contact data: retained for 12 months from the date of last contact, unless a service relationship is established.
• Service user records: retained in accordance with Scottish Government and Care Inspectorate guidance on records management in health and social care. As a general principle, care records are retained for a minimum of 8 years following the end of the care relationship, or until the service user's 25th birthday if they were under 18 at the time of the last entry, whichever is later.
• Staff and contractor records: retained in accordance with employment law and HMRC requirements.
When personal data is no longer required, it is securely deleted or destroyed.
9. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
• Right of access: to obtain a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate data corrected without undue delay.
• Right to erasure: to request deletion of your data where there is no compelling reason for its continued processing.
• Right to restriction of processing: to ask us to limit how we use your data in certain circumstances.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Rights in relation to automated decision-making: we do not make solely automated decisions with significant effects on individuals.
To exercise any of these rights, please contact us at contact@twogoodfriends.co.uk. We will respond within one calendar month of receiving a valid request. We will not charge a fee for reasonable requests.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
10. Cookies
Our website uses cookies and similar technologies. Please refer to our separate Cookie Policy for full details of the cookies we use, the purposes for which they are used, and how you can manage your preferences.
11. Security
We take the security of personal data seriously. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures are reviewed and updated as our services develop.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it and, where required, notify affected individuals without undue delay.
12. Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom.
ICO website: www.ico.org.uk | Helpline: 0303 123 1113
We would, however, ask that you contact us first so that we have an opportunity to address your concerns before you escalate to the ICO.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the law, regulatory guidance, or our operating practices. The current version will always be published on our website with the effective date shown at the top of this document. Where changes are material, we will take reasonable steps to bring them to your attention.
14. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data subject rights, please contact us:
Two Good Friends (Tenlu Group Limited)
Email: contact@twogoodfriends.co.uk
Care Inspectorate Registration: SP2025000222
.
.