1. Purpose of our privacy statement
1.1 Under the Data Protection Act 2018 and the UK GDPR we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
2. Who are we?
2.1 Sanctuary Addenbrooke's is a trading name used by Sanctuary Housing Association for accommodation services at Addenbrooke's Hospital.
2.2 Sanctuary Housing Association is an exempt charity and part of Sanctuary Group (“Sanctuary”), one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
3. Our data protection officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
3.2 If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing email@example.com.
4. Why are we collecting your information?
4.1 The information that you provide to us during routine enquiry channels such as via our website, in person, during a telephone call, during the contracting process or while you are staying with us, is required by Sanctuary in order for us to provide you with a requested service and meet our contractual obligations under your accommodation agreement. We need to collect this information because without it we will not be able to provide you with accommodation services under your accommodation agreement.
4.2 We will also use your contact details to keep you updated about other accommodation you may be interested in in the future, unless you opt out of these marketing communications. We also conduct customer research with a view to improving services. You can opt out by ticking the relevant box during the contracting process. You can also change your mind about marketing communications at any time. Please contact us if you would like to manage or update your marketing preferences.
5. What information are we collecting?
5.1 The information that you provide to us via our booking portal, in person, on forms or during any enquiry will be used to provide you with a service or accommodation. The information we collect may include, for example:
- Name, Address and Contact details
- Date of Birth, Passport Number (if applicable)
- Nationality, Next of Kin details, Guarantor details (if applicable)
- CCTV monitoring
- Passport sized photograph (if applicable)
- Direct Debit mandates
- Health and disability information
5.2 Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes information about any relevant health conditions or specific needs that our staff should be aware of when delivering accommodation services for you.
5.3 As part of the contracting process, if applicable, we will direct you to our external electronic payment provider who will process payments as agreed in your accommodation services contract.
6. What we are going to do with your information
6.1 The information you provide to us will be used for the following purposes:
- 6.1.1 It will be stored and used by us in accordance with this privacy statement and also in accordance with your rights under the Data Protection Act 2018 and the UK GDPR;
- 6.1.2 It will be collected and used by us fairly and openly for the purpose of providing our services to you and tailoring such services to your needs;
- 6.1.3 It will be used to improve the services you receive from us;
- 6.1.4 It will enable us to ensure that we can provide you with the service requested and meet the terms of your accommodation services contract; and
- 6.1.5 It will allow us to make contact with you in the most appropriate way. For example, we can provide literature in large print if you have difficulty reading smaller print; or provide documents in an alternative language if English is not your preferred language.
- 6.1.6 Unless you opt out of marketing communications during the contracting process, we will use your data to keep you informed about future accommodation provision that may be of interest. You can opt out of these communications at any time.
- 6.1.7 We may use your information (such as location or home address information) in an aggregated way to improve our services and target our marketing activities appropriately. This may include defining groups of our customers or potential customers based on factors such as age, location, and method of communication so that we can identify trends and improve our services. Using your information in this way will help us provide relevant content to those more likely to be interested in our services. We do not use this information to make any significant decisions about our individual customers, but you can opt out of your data being used in this way by contacting us.
6.2 Some of the information which we collect will be special categories of personal data (also called sensitive personal data), such as any disability you may have. You need to be aware that where you have told us about a specific health condition or disability (sensitive personal data), we will use this information in order to provide the most appropriate accommodation depending on your specific needs. Providing this information is voluntary but please note that not providing this information may result in accommodation being allocated which is not suitable for your specific needs or any health condition or disability you do not tell us about.
7. What is the legal basis for using your information?
7.1 In accordance with the data protection laws, we need a "legal basis" for collecting and using information about you. There are a variety of different legal basis for processing personal data which are set out in the data protection laws.
7.2 The legal basis on which we rely in order to use the information which we collect about you, for the purposes set out in this notice will be:
- 7.2.1 that it is necessary for us to process your enquiry and enter into and deliver accommodation services under the contract between us;
- 7.2.2 that it is necessary for us to comply with a legal obligation to which we are subject; and
- 7.2.3 for marketing enquiries, that you have given permission (express or via soft-opt in) to be included in marketing communications.
7.3 The legal basis on which we rely in order to use your special categories of personal data (sensitive data such as disability data) will be that you have provided your explicit consent to our use of this information.
7.4 The legal basis on which we rely to use your information to improve our services and target our marketing activities will be that it is in our legitimate interests to do so.
7.5 We may also ask about any relevant health conditions that our staff should be aware of when performing in-person accommodation services for you (for example, whether you have recently tested positive for Covid-19). We do this on the legal basis that this is necessary for us to ask this information in order to ensure the health and safety of our staff is maintained when carrying out services onsite in your accommodation.
8. Sharing your information
Members of Sanctuary Group
8.1 Sanctuary is made up of a number of related companies. We will share your information with other members of our Group where necessary in order to best provide accommodation services to you in accordance with the contract between us.
8.2 Your information will only be accessed by other Sanctuary Group companies where it is necessary to do so in order to provide services to you in accordance with your enquiry and any contract. The obligations which are set out in this notice shall apply to the other members of our Group to the same extent that they apply to us.
8.3 For more information on which companies make up Sanctuary, please go to Sanctuary.
Contractors and sub-contractors
8.4 It may be necessary to share information about you with our contractors and sub-contractors in order to provide you with accommodation services in accordance with the contract between us. We will only share information about you with contractors and sub-contractors which is relevant and necessary to address your individual needs and/or maintain the health and safety of personnel attending site. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and / or the UK GDPR.
8.5 Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on our behalf.
Regulators and other legal obligations
8.6 We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
8.7 We may from time to time share your information with other organisations, such as:
- 8.7.1 Partner organisations whom we have data sharing agreements with for example University/NHS Trusts/Agencies acting on our behalf;
- 8.7.2 Utility companies so they can provide services to you and contact you in respect of utility charges (only if applicable);
- 8.7.3 The police for the purpose of detection and prevention of crime; and
- 8.7.4 Mail or parcel delivery organisations who have incomplete delivery address details in order to facilitate delivery of parcels addressed to you. If we utilise delivery notifications where you live, we share the required details for example; name, address and contact details in order to provide this service.
8.8 To assist the management of our contracts we may utilise debt recovery/deposit protection and credit reference agencies where applicable in order to enforce our payment rights for accommodation services provided. If applicable, we will also share information with your nominated guarantor.
9. Transferring your information abroad
9.1 We use a third party processor, Campaign Monitor, for some of our email campaigns and we transfer your information to Campaign Monitor for the purpose of sending e-marketing and communication emails to you. Campaign Monitor is a global business that is headquartered in Australia and uses a data centre located in the United States of America, so their processing of your personal data will involve a transfer of data outside the UK.
9.2 Our payment platform provider, WPM, use sub-processors who are located outside of the UK – these sub-processers are located in the European Economic Area and the United States of America and are for the purpose of content distribution, security and data centres hosted outside of the UK. If you use our payment platform provider their processing of your personal data will involve a transfer of data outside the UK.
9.3 Whenever we transfer your personal data out of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that we rely on an adequacy decision and/or use specific contract clauses which give personal data the same protection it has under UK law.
9.4 Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside of the UK.
10. Security of your information
10.1 The information that you provide will be stored securely on our systems and any paper records you have completed will be shredded. Our security measures and procedures reflect the seriousness with which we approach security and the value we attach to your information.
10.2 Only relevant members of staff will access the information you provide to us, and all staff are subject to duties of confidentiality.
11. Can we use your information for any other purpose?
11.1 In limited circumstances we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
12. Storing your information and deleting it
12.1 We will store the personal data which you provide to us for as long as you remain a service user or are in receipt of accommodation services. Once you are no longer a service user of ours, we will review the information which we hold concerning you and determine whether there are any reasons why we need to continue holding that information. For example, if a service user is in arrears when they leave the property, it may be necessary to retain information about them in order to recover those arrears. There also may be regulatory and/or our business best practice requirements which dictate the length of time the data is held.
12.2 Once the identified purpose comes to an end, unless there is another identifiable purpose for which it is necessary to hold on to your information, we will delete your information.
13. Your rights
13.1 In relation to the information which we hold about you, you are entitled to:
- 13.1.1 Ask us for access to the information;
- 13.1.2 Ask us to rectify the information where it is inaccurate or is incomplete;
- 13.1.3 Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
- 13.1.4 Ask us to limit what we do with your information;
- 13.1.5 Object to our use of your information and ask us to stop that use;
- 13.1.6 Instruct us to provide you with the information we hold about you in a structured and commonly used format or transmit that information directly to another organisation (for example, if you want the information to be sent to another accommodation provider).
13.2 Our obligations to comply with the above rights are subject to certain exemptions.
13.3 Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected.
13.4 To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing firstname.lastname@example.org.
13.5 You also have the right to complain to the Information Commissioner's Office (ICO) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.