Creating Future Opportunities (CFO) Evolution Privacy Notice

Creating Future Opportunities (CFO) Evolution Privacy Notice

Who are we? 

Ingeus UK Limited is a private limited company registered with Companies House, company no. 04320853.  Second Floor, 66-68 East Smithfield, Royal Pharmaceutical Building, London E1W 1AW. We are registered with the Information Commissioners Office Z804306X.  

We are all about people, delivering services that make a positive, lasting difference to people's lives, including employment and health programmes, services for young people, training and skills support, and support for people in the justice system.  

When you use the services of Ingeus UK Limited, you may provide us with your Personal Data. We only collect data to administer your interaction with us.  

We treat your information with the appropriate security, ensuring that whatever information you provide us with, is safe.  

How we secure your data? 

Ingeus implements industry leading controls to ensure that information is secure. We are accredited to the information security standards ISO27001:2002 and Cyber Essentials Plus. All staff are required to pass Baseline Personal Security Standard (BPSS) and complete data security training when the join the business, then at least annually. 

What is CFO Evolution  

Ingeus UK Limited has been commissioned by the Ministry of Justice to provide the CFO Evolution. Ingeus and our Delivery Partners, with whom Ingeus has legal agreements, collect and use information obtained from yourself and MOJ in order to deliver the CFO Evolution programme. CFO Evolution supports individuals who have been referred by Probation Officers and other community justice professionals. Services are tailored to the needs of individuals (based on a needs assessment and action planning) to help them overcome barriers.    

MOJ is the Data Controller for the processing of personal data in relation to the CFO Evolution.  

Ingeus is the Data Controller for any data provided directly to the delivery of the services.  

How do we collect your information?

There are many ways that we at Ingeus UK Limited collect your personal details. We obtain limited initial information about your Probation Officers and other community justice professionals.  

We will obtain further information from you directly during appointments and other interactions. We may also gain information from partner organisations who support you whilst access our service.  

What Personal Data do we collect from you?

We collect different types of personal data from you depending on the service you access. Typically, we will collect:  

  • Name – to identify you 
  • Address – to identify you 
  • Email – to keep in contact with you 
  • Telephone Number – to keep in contact with you 
  • National Insurance Number – to identify you
  • Date of Birth – to identify you; for equality and diversity monitoring  
  • Sex – for equality and diversity monitoring 
  • Health Information – limited information where relevant to the service 
  • Employment History – where relevant to the service 
  • Qualifications – where relevant to the service
  • Financial Information – limited information where relevant to the service
  • Housing and accommodation - limited information where relevant to the service
  • Criminal Record History – limited information where relevant to the service

What we use your information for?  

We use the information you provide to: 

  • Provide the service you have referred to 
  • Track your journey and progress through the service 
  • Improve our services - we may also use your information in research and evaluation activities 
  • Demonstrate compliance to the commissioner of the service – this impact funding and grants we receive 

What is the Lawful Basis for processing your Personal Data?

The law on data protection sets out a number of different reasons for which businesses may collect and process your personal data: 

1.    To meet our contractual obligations - with HMPPS and Ministry of Justice  

2.    To meet our legal obligations  

In some circumstances we are required to pass on details to  

  • Law enforcement when asked to support an active criminal investigation 
  • HMRC or DWP in instances where fraud is suspected  
  • Emergency services or your GP to assist you or to provide emergency response in high-risk situations. 
  • Meet our obligations under safeguarding (children and vulnerable adults) or Prevent legislation.

3.   Because there is a Legitimate interest - In order for us to provide the services to you.  

4.  To meet Public Task obligations - Some of the information we collect and retain will be processed under public task obligations required by MOJ.  

5. Because we have obtained your consent – we will ask to you consent to the collection, processing and retention of your personal data when you join the programme.  

How long is your information kept by Ingeus UK Limited? 

The length of time we need to retain your personal information for is dependent upon the service you access. We regularly review how long we keep your Personal Data; however, we do have certain legal obligations to retain some types of information for specific periods of time. Currently we are required to retain your personal information until 1st January 2028. 

Who has access to your Personal Data? 

Ingeus UK Limited staff involved in the delivery of the service to you, will have access to your personal data.  

Where the service is delivered by one of our delivery partners, they will also have access.  

We share limited information with our commissioners. They do not have access to, nor do we share a full record of the data you share with us.   

Marketing and Communications 

The Ingeus UK Limited marketing team delivers activities that are designed to promote and communicate updates about us. We use our websites, social media accounts and other channels such as email, to carry out our marketing activities. We may ask for your consent to opt into receiving marketing communications. You can opt out of this at any time.  

Your Data Rights 

  • The Right to Access

You have the right to access the information that Ingeus UK Limited holds about you. You can reasonably expect to receive the information we hold about you within 30 calendar days of us verifying your request. Please note – we provide information in readily accessible digital formats such as msg, xlsx, pdf, docx, jpeg, pptx.  

  • The Right to Data Portability

You have the right to move, copy or transfer the Personal Data we hold from one IT environment to another in a safe and secure manner. Please be aware, this only relates to electronic information and not paper files. 

  • The Right to Rectification

You have the right to correct any personal information that we hold that may be incorrect.  

  • The Right to Object to Processing

This right allows to you to stop Ingeus UK Limited using your Personal Data at any time for purposes such as direct marketing. Please note, there are exceptions to this right.  

  • The Right to Erasure (Right to be Forgotten)

In certain circumstances, you can ask us to erase any personal data that we hold.  

Please note – The right of erasure is not an absolute right. We will assess every request in accordance with ICO guidance and based on its individual circumstances. We can legally decline a request if the data is still required to meet legal or contractual obligations or if it is still required for the reasons it was originally collected it i.e. to deliver the service. We will make you aware of any issues that may arise when you access this right. We will also consult with our commissioners when making a decision.  

  • The Right to Restriction of Processing

You have the right to restrict the processing of your Personal Data. This means you can limit the way we process your information in certain circumstances.  

To access any of these right or have any queries, then please contact us at dataprotectionofficer@ingeus.co.uk. In accordance with ICO guidance, we will ask to verify your identity before we enact your data rights.  

NB - Right of Access Requests we will also be directed to MOJ data.access@justice.gov.uk  

Contact Us  

We always want to make sure that we as an organisation, are as transparent as possible. However, if you do have any questions, queries or complaints please don’t hesitate by contacting us:  

  • by email: dataprotectionofficer@ingeus.co.uk
  • or by post to this address: 
    The Data Protection Officer
    Ingeus UK Limited
    Second Floor
    66-68 East Smithfield
    Royal Pharmaceutical Building
    London
    E1W 1AW  

You have the right to escalate any concerns you may have about our data processing with the ICO. They can be contacted through their website www.ico.org.uk.

 This Privacy Notice was last reviewed on the 31st January 2026.