Who are we?
We are Sanctuary Housing Association, a part of Sanctuary Group (‘Sanctuary’) one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
The Warm Homes: Social Housing Fund (WH:SHF) Wave 3 is a government initiative aimed at improving the energy efficiency of social housing properties in England that provides financial support to housing associations to implement measures that reduce energy consumption and improve the comfort of residents.
Sanctuary as a grant recipient participating in the WH:SHF Wave 3, are committed to improving the energy efficiency of our housing stock.
For this purpose, Sanctuary collects your information to ensure the effective delivery of the programme, including assessing eligibility, managing applications, monitoring progress, and evaluating the outcomes of funded projects.
Additionally, the data collected will also be used to prevent the duplication of support under other government schemes that may breach WH:SHF Wave 3 rules or to help to prevent fraud, error and non-compliance.
What information are we collecting?
To enable delivery of WH:SHF Wave 3 we collect and process the following categories of personal data:
Households offered installations under WH:SHF Wave 3
- Name, address, and contact details;
- Information about your household, including the number of occupants and any specific needs;
- The address and details about the properties receiving installations, including its current energy efficiency rating and any existing heating systems;
- Details of the energy efficiency measure, or low carbon heating system installed, including type, size, cost and month of completed installation;
- information of the property from Energy Performance Certificate such as the property rating, banding, features, assessor details etc;
- The amount of funding the household contributed towards installations (if applicable);
Contractor/installer information
- Contractor’s company name and contact details;
Following an initial introduction by our Energy Team, the external contractor will become the main point of contact for customers for all matters related to the retrofit process. This arrangement ensures that customers receive direct and consistent communication throughout the duration of the works.
Special category data
During property visits as part of the retrofit process, the external contractor may ask customers to share certain types of sensitive personal information, known as special category data, such as details about health conditions or disabilities. This information is requested solely to help arrange suitable access to the property and ensure that any specific needs are appropriately accommodated.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
Performance of a task carried out in the public interest. The public tasks are outlined above and include delivery of the programme, including assessing eligibility, managing applications, monitoring progress, evaluating the outcomes of funded projects, prevention of duplication of support under other government schemes, prevention and detection of fraud, error and non-compliance with WH:SHF Wave 3 rules.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
Reasons of substantial public interest.
Our basis in Law is Section 16(1)(a) of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for providing support to individuals with a particular disability or medical condition,
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
Information will be shared with the Department for Energy Security and Net Zero (DESNZ) – to comply with the conditions of our grant and enable DESNZ to review and manage the operation of WH:SHF Wave 3, evaluate whether the programme has met it policy objectives, mitigate fraud, non-compliance, funding duplication and facilitate official statistical reports on the delivery of WH:SHF Wave 3.
For more information about how DESNZ uses your data, please see their privacy notice available from their website:
Data processors
To facilitate delivery of the WH:SHF Wave 3, we may share your information with data processors acting on our behalf to ensure the effective delivery and management of the programme. These include:
Installers: Companies and contractors who carry out the installation of energy performance measures.
Retrofit Coordinators: Professionals responsible for overseeing the retrofit process and ensuring quality and compliance.
Auditors: Independent auditors who assess the compliance and effectiveness of the programme.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will keep the personal data included within WH:SHF Wave 3 for seven years following the purpose it was used for.
For the purposes of prevention and detection of fraud, error and non-compliance, some data will be stored and shared for a maximum of 25 years. Individual records may be retained beyond this if they relate to ongoing actions such as prosecutions, appeals or debt recovery.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.