On this page
Who are we?
We are Sanctuary Housing Association, a part of Sanctuary Group (“Sanctuary”), one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
What we do (processing activities)
Why are we collecting your information?
The information that you provide to us during routine enquiry channels such as via our website, other platforms for example Viva City Web Chat, in person, during a telephone call, or during the registration or application process, is required by Sanctuary for us to provide you with a requested service or an offer of accommodation. We need to collect this information because without it we will not be able to provide you with accommodation services or enter a contract with you.
If you agree, we would like you to contact you about accommodation you have expressed an interest in, as well as accommodation that may interest you in the future. This is voluntary and if you consent, we will contact you about other services that are relevant to you.
If you proceed with your application and become a customer of ours, we will assume you are happy to receive information about future accommodation, unless you choose to opt out of receiving these communications.
You can change your mind about marketing communications at any time. Please contact us if you would like to manage or update your marketing preferences.
We may also use your information to improve the services you, and other customers, receive from us as well for market intelligence purposes to enable us to target our marketing activities appropriately.
What information are we collecting?
The information that you provide to us via our booking platform, in person, on forms or during any enquiry will be used to provide you with a service or offer you accommodation. The information we collect may include, for example:
- Name, address and contact details
- Date of Birth
- Gender
- Year of study, university/college course details
- Emergency Contact details
- Financial information
- Guarantor details (if applicable)
- Accommodation preferences (e.g. preferred room type, sharing preferences)
- Employer details (if applicable)
- "Right to Rent" documentation/evidence (if applicable)
- Nationality
- Previous addresses, employment information (if applicable)
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information about any relevant health conditions or specific needs that our staff should be aware of. This will also enable us to determine whether we have suitable accommodation and enable us to allocate the most appropriate accommodation depending on your needs.
We may also receive personal information indirectly, from the following sources in certain circumstances:
- Universities
- FE institutions
- NHS Trusts
- Marketing and referral agencies
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
- Consent
- Performance of a contract
- Compliance with a legal obligation
- Our legitimate interests or that of a third party.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
- Explicit consent
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
Your information will only be accessed by other Sanctuary Group companies where it is necessary to do so in order to provide services to you in accordance with your enquiry and any future contract. The obligations which are set out in this notice shall apply to the other members of our Group to the same extent that they apply to us.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Contractors and sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors to provide you with the services in accordance with your enquiry and any future contract between us. We will only share information about you with contractors and sub-contractors which is relevant and necessary to address your individual needs.
Our contractors and sub-contractors will not share your information with any other parties and will only by able to use the information when completing work on our behalf.
Other organisations
We may from time to time share your information with other organisations, such as:
- Partner organisations whom we have data sharing agreements with, for example University/NHS Trusts/Agencies acting on our behalf.
For our commercial and market rent customers, we may share your information with credit reference agencies to enable us to determine your suitability to enter a contract with us.
Data processors and Transfers
To facilitate the delivery of services to you, we use the following categories of data processors who process information on Sanctuary’s behalf:
- Booking, lettings and marketing agents
- Payment service providers
- Software provider for technical IT system support.
We also use a third-party processor, Campaign Monitor, for some of our email campaigns and we transfer your information to Campaign Monitor for the purpose of sending e-marketing and communication emails to you. Campaign Monitor is a global business that is headquartered in Australia and uses a data centre located in the United States of America, so their processing of your personal data will involve a transfer of data outside the UK.
Whenever we transfer your personal data out of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that we rely on an adequacy decision and/or use specific contract clauses which give personal data the same protection it has under UK law.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside of the UK.
Storing your information and deleting it
We will store the personal data which you provide to us for as long as you remain an applicant and/or service user. Following this your information will be retained for 6 years.
For applications which do not result in the use of our services information is retained for 3 years.
Information held for marketing purposes will be stored for as long as you agree with your information being held for this purpose. We will review and refresh consent with you regularly.
Information held for marketing purposes will be stored for as long as you agree with your information being held for this purpose. We will review and refresh consent with you regularly.
Why are we collecting your information?
The information that you provide to us during routine enquiry channels such as via our website, other platforms for example Viva City Web Chat, in person, during a telephone call, during the contracting process or while you are staying with us, is required by Sanctuary for us to provide you with a requested service and meet our contractual obligations under your accommodation agreement.
We need to collect this information because without it we will not be able to provide you with accommodation services under your accommodation agreement.
We may also use your information to improve the services you, and other customers receive from us as well as for market intelligence purposes to enable us to target our marketing activities appropriately.
We will also use your contact details to keep you updated about other accommodation you may be interested in in the future unless you opt out of these marketing communications.
We also conduct customer research with a view to improving services. You can opt out by ticking the relevant box during the contracting process. You can also change your mind about marketing communications at any time. Please contact us if you would like to manage or update your marketing preferences.
What information are we collecting?
The information that you provide to us via our booking portal, in person, on forms or during any enquiry will be used to provide you with a service or accommodation. The information we collect may include, for example:
- Name, address and contact details
- Date of Birth
- NI number, Passport Number (if applicable)
- Emergency contact details
- Guarantor details (if applicable)
- Student ID (if applicable)
- Financial Information
- Passport-sized photograph (if applicable)
- Direct Debit mandates (Keyworkers only)
- “Right to Rent” documentation/evidence (if applicable)
- Nationality
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes information about any relevant health conditions or specific needs that our staff should be aware of when delivering accommodation services for you. This information would also be used when considering, for example, any requests for adaptations, adjustments or specialist equipment and therapy pets.
We may also collect ethnicity information for equality and diversity monitoring purposes. Providing this information is voluntary.
As part of the contracting process, if applicable, we will direct you to our external electronic payment provider who will process payments as agreed in your accommodation services contract.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(b) Performance of a contract.
(c) Compliance with a legal obligation.
(d) To protect the vital interests of an individual or third party.
(f) Our legitimate interests or that of a third party.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(a) Explicit consent
Sharing your information
Members of Sanctuary Group
Sanctuary is made up of a number of related companies. We will share your information with other members of our Group where necessary in order to best provide accommodation services to you in accordance with the contract between us.
Your information will only be accessed by other Sanctuary Group companies where it is necessary to do so in order to provide services to you in accordance with your enquiry and any contract. The obligations which are set out in this notice shall apply to the other members of our Group to the same extent that they apply to us.
For more information on which companies make up Sanctuary, please go to About Sanctuary.
Contractors and sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors in order to provide you with accommodation services in accordance with the contract between us. We will only share information about you with contractors and sub-contractors which is relevant and necessary to address your individual needs and/or maintain the health and safety of personnel attending site.
Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on our behalf.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- Partner organisations whom we have data sharing agreements with for example Universities/NHS Trusts/customer referral agencies acting on our behalf;
- Utility companies so they can provide services to you and contact you in respect of utility charges (only if applicable);
- Mail or parcel delivery organisations who have incomplete delivery address details in order to facilitate delivery of parcels addressed to you. If we utilise delivery notifications where you live, we share the required details for example; name, address and contact details in order for us to provide this service.
- Relevant organisations or provided emergency contacts may be contacted in instances where we have formed vital concerns that you may either be at immediate risk of harm or pose such a risk for example NHS crisis teams or mental health crisis teams; any educational institution with a legitimate interest; the police and provided emergency contacts. Wherever possible we will inform you that we have made such a disclosure.
- To assist the management of our contracts we may utilise debt recovery/deposit protection where applicable to enforce our payment rights for accommodation services provided. If applicable, we will also share information with your nominated guarantor.
Data processors and Transfers
To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Debt Collection Agencies
- Payment Service Providers
- Referencing Agencies
- Software provider for technical IT system support.
We use a third-party processor, Campaign Monitor, for some of our email campaigns and we transfer your information to Campaign Monitor for the purpose of sending e-marketing and communication emails to you. Campaign Monitor is a global business that is headquartered in Australia and uses a data centre located in the United States of America, so their processing of your personal data will involve a transfer of data outside the UK.
Our payment platform provider, WPM, use sub-processors who are located outside of the UK. These sub-processers are located in the European Economic Area and the United States of America and support distribution, security and hosted data centres. If you use our payment platform provider their processing of your personal data will involve a transfer of data outside the UK.
Whenever we or one of our data processors transfer your personal data outside of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that specific contractual clauses are implemented which give personal data the same protection it has in the UK.
Please contact us if you want further information on the specific mechanism used when your personal data is transferred outside of the UK.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law. We will retain your information for 6 years following the end of your accommodation agreement.
Why are we collecting your information?
You have indicated that you are willing to provide credit support (in the form of a Guarantee) to Sanctuary to enable us to provide student accommodation services to your relative, friend or contact.
The information that you provide us during the Guarantor process is required by Sanctuary for us to enter a legal contract of guarantee with you and meet the obligations of that contract.
Without this information we would not be able to enter a contract of guarantee with you.
Where applicable we may also receive your personal information indirectly, from universities for this purpose.
What information are we collecting?
We process the following information to set up and perform a contract of Guarantee between us:
- Name
- Address
- Contact Details
- Date of Birth
- Proof of Address (for example a copy of a utility bill)
- Financial Details
- Signed deed of guarantee, which includes signature, witness signature and occupation details
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(b) Performance of contract
(f) Our legitimate interests or that of a third party
Sharing your information
Members of Sanctuary Group
Sanctuary is made up of a number of related companies. We will share your information with other members of our Group where necessary in order to best facilitate the contract between us.
Your information will only be accessed by other Sanctuary group companies where it is necessary in accordance with your contract. The obligations which are set out in this notice shall apply to the other members of our Group to the same extent that they apply to us.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- Partner organisations whom we have data sharing agreements with, for example Universities and NHS Trusts
Data processors and Transfers
To facilitate this process, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Debt Collection Agencies – arrears management
- Legal Partner – Arrears management
- Payment service providers
Our payment platform provider, WPM, use sub-processors who are located outside of the UK. These sub-processers are located in the European Economic Area and the United States of America and support distribution, security and hosted data centres. If you use our payment platform provider their processing of your personal data will involve a transfer of data outside the UK.
Whenever we or one of our data processors transfer your personal data outside of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that specific contractual clauses are implemented which give personal data the same protection it has in the UK.
Please contact us if you want further information on the specific mechanism used when your personal data is transferred outside of the UK.
Storing your information and deleting it
We will store the personal data which you provide to us for as long as your contract of Guarantee remains in place. Following settlement of the account this information will be retained for 6 years.
Why are we collecting your information?
Sanctuary uses Video Surveillance Management Systems (commonly known as CCTV) to help reduce the fear or threat of crime, to protect customers, staff, our premises, fixtures, fittings, and property.
Video surveillance images will be used to:
- assist in the prevention and detection of crime
- facilitate the identification, apprehension and prosecution of offenders in relation to crime;
- ensure the security of Sanctuary customers, employees, visitors and property;
- facilitate appropriate door and site access;
- reduce incidences of vandalism and criminal damage; and
- enhance the feeling of security provided to residents, staff, and customers.
What information are we collecting?
We collect and process video surveillance images. These images may reveal or enable the inference of special categories of data (also called sensitive personal data), such as any disability or health conditions, racial or ethnic origin as well as religious beliefs.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
- Our legitimate interests or that of a third party.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
- Reasons of substantial public interest.
Our basis in Law is Section 10 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of the prevention or detection of an unlawful act.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- insurance companies or solicitors, in connection with any claims where evidence of video surveillance footage is required.
Data processors and transfers
To facilitate this process, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- security companies that are responsible for on-site security and monitoring of surveillance footage (where applicable at specific sites).
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law
We retain video surveillance footage for 28 days at which point the information is automatically deleted.
Why are we collecting your information?
To enable customers, residents and the public to raise enquiries and/or seek information about our services.
If your enquiry relates to a service failure, the information that you provide will also be used for the purpose of improving our products and services.
What information are we collecting?
The information that we collect about you will include your name and contact details, and any other information which you provide to us via email, social media message, telephone, or by completing an enquiry form from our website.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(f) Our legitimate interests or that of a third party in enabling customers, residents and the public to engage with Sanctuary on the services available, seek information and or support.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to answer or resolve your query.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Contractors and sub-contractors
It may be necessary to share information about you, with our contractors and sub-contractors to resolve your enquiry for example if you report a fault and require a repair. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
To facilitate enquires through our website and social media channels the following categories of data processors process information on Sanctuary’s behalf:
- Website hosting partner
- Social media management providers
One of our social media management providers, Hootsuite, uses sub-processors who may process and store information in the United States of America or other countries. Where this happens, Hootsuite has standard contractual clauses in place to ensure any information transferred has adequate protections in place and is compliant with data protection laws.
For further information about what international data transfers occur at Hootsuite please visit Privacy (hootsuite.com).
Storing your information and deleting it
Following resolution of your enquiry, your information will be retained as outlined below:
- Web forms submitted via our websites are retained for 30 days.
- Social media private messages are retained for two weeks.
- Emails are retained for a minimum of one year and are automatically deleted after three years.
- Telephone recordings are retained for 30 days. Please note not all telephone calls are recorded.
Why are we collecting your information?
Information you provide to us is voluntary and will be used to support our communication and marketing activities. This may include promotional materials, press releases, social media posts, case studies and corporate documents.
Our materials may be published internally within Sanctuary as well as externally to our residents, on our social media channels and our websites.
What information are we collecting?
We currently collect and process the following information:
- Name
- Age/Date of birth
- Contact details including your email, phone number and your address; and
- Photos, videos or audio recordings (if applicable)
- Personal experiences (if applicable)
If you choose to provide it, some of the information which we collect may be special categories of personal data (also called sensitive personal data), which includes the following information:
- Health-related information, including disability
- Sexual orientation
- Racial or ethnic origin; and
- Religious beliefs
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
- You have given your consent. You can remove your consent at any time by contacting communications@sanctuary-housing.co.uk.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
- Explicit consent
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate our marketing and communication activities.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Contractors and sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors, for example with an external design, website or digital agency, when creating our marketing materials. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
With your consent we may from time to time share your images and information provided with our partners to support our communication and marketing activities.
Data processors and Transfers
To facilitate our communication and marketing activities, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Photographers and videographers;
- Website and digital agencies;
- Marketing and PR agencies;
- Media organisations;
- Printing companies;
- System providers (in circumstances of technical IT support)
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We will retain the information you provide for 5 years, unless you contact us to withdraw consent earlier than this date.
We may from time to time seek to ‘refresh’ your consent, at which point we would retain your information for a further 5 years from the date consent was refreshed.
Why are we collecting your information?
Data protection laws aim to empower individuals and give them greater control over their personal data through several rights including:
- Right of access – referred to by Sanctuary as a DSAR (Data Subject Access Request), gives individuals the right to obtain a copy of their personal data from us, as well as other supplementary information.
- Right to rectification – to have inaccurate personal data rectified, or completed if it is incomplete. This right is not absolute and in certain circumstances we can refuse a rectification request.
- Right to erasure – the right to have their personal data erased. This right is not absolute and in certain circumstances we can refuse an erasure request.
- Right to restrict processing – to restrict the processing of their personal data. For example, Sanctuary could continue to store personal data but not use it. This right is not absolute and in certain circumstances we can refuse a request.
- Right to data portability – to obtain and reuse their personal data for their own purposes across different services. The right only applies to information an individual has provided to Sanctuary and where the lawful basis for processing is consent or performance of a contract. Paper records are excluded from this right.
- Right to object – the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing. The right effectively allows individuals to stop or prevent organisations from processing their personal data, though is not absolute and in certain circumstances we do not have to comply.
- Rights related to automated decision making and profiling – restricts organisations from making solely automated decisions, by enabling individuals to request human intervention or challenge a decision that has been made.
Sanctuary is committed to protecting the rights of data subjects and ensuring compliance with all applicable data protection laws in the UK. The information we collect, and process will be used to administer your data subject rights request.
What information are we collecting?
To facilitate your request, we will collect and process the following information:
- Name
- Contact details, such as address, email address and telephone number
- Identification documentation
- Details of the scope of request
- Third party authority data (where applicable)
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
- Compliance with a legal obligation – using your information is necessary for us to comply with a legal obligation to which we are subject in accordance with UK data protection law.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate your request.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them, for example if you raise a complaint with Information Commissioners Office about the handling of your request.
Other organisations
We may share your information with other organisations where relevant in order to comply with your request of erasure, restriction, objection or rectification where we had previously shared that information with our partner organisations.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law
Following completion of your request or any subsequent complaint to the Information Commissioners Office, the case file will be retained for one year before deletion.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security and your rights
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Your rights
In relation to the information which we hold about you, you are entitled to:
- Ask us for access to the information.
- Ask us to rectify the information where it is inaccurate or is incomplete.
- Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it.
- Ask us to limit and restrict what we do with your information.
- Object to our use of your information and ask us to stop that use.
- Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order to transmit the data to another data controller;
- Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing.
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the 'ICO') if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.