1. Purpose of our privacy statement
1.1 Under the Data Protection Act 2018 and the General Data Protection Regulation, we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
2. Who are we?
2.1 We are Sanctuary Scotland Housing Association Limited, a part of Sanctuary Group (‘Sanctuary’) one of the UK's leading providers of housing, care and commercial services. Our address is 7 Freeland Drive, Priesthill, Glasgow, G53 6PG.
3. Our Data Protection Officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
3.2 If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
4. Why are we collecting your information?
4.1 Basic factoring information
4.1.1 The information that you provide to us while you are a recipient of factoring services is required by Sanctuary in order for us to provide you with our basic factoring services. This will include basic identifier information about you, contact details, and information about any relevant health conditions or specific needs that our staff should be aware of when performing factoring and maintenance services for you.
4.1.2 Without this information, we will not be able to contact you about the services scheduled or completed. We also require this information to contact you should an emergency arise at your property or block and we need to arrange access to resolve the issue, or if we require you to take action to resolve the issue.
4.2 Customer feedback
4.2.1 While you are in receipt of factoring services, Sanctuary may invite you to participate in satisfaction surveys. We will use the contact details you provide to make this invitation but participation is entirely voluntary and if you do not wish to participate you can simply ignore the invitation.
4.3 Equality and diversity information
4.3.1 From time to time, Sanctuary may invite you to share data on your diversity characteristics.
4.3.2 This is voluntary and can only be recorded and used by us with your explicit consent. You can also withdraw your consent at any time.
4.3.3 We ask for this data to improve our services. Our aim is that by further understanding your individual needs, we will be able to provide an improved service.
4.3.4 Collecting equalities data is also part of Sanctuary’s Equality Strategy: Inclusion for All and is therefore a core element of governance and making sure that we listen and respond to the needs of our residents and service users, promote their interests and enhance trust within our community.
4.3.5 Sanctuary also collects and uses data on characteristics such as ethnicity, disability and gender re-assignment to protect people from unlawful discrimination.
5. What information are we collecting?
5.1 We are collecting information about you which you provide to us on the forms completed and in any correspondence or discussions with you during the time that you are in receipt of our factoring services.
5.2 Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes information about your health, religion, gender re-assignment, age, marriage and civil partnership, sex, sexual orientation, and racial or ethnic origin.
5.3 Some of the information which we collect will also include data such as your preferred language, current and historical financial circumstances and personal circumstances.
6. What we are going to do with your information
6.1 The information you provide to us will be used for the following purposes:
6.1.1 It will be stored and used by us in accordance with this privacy statement and also in accordance with your rights under the Data Protection Act 2018 and the UK GDPR;
6.1.2 It will be collected and used by us fairly and openly for the purpose of providing our services to you;
6.1.3 It will allow us to comply with our legal duty to make reasonable adjustments to our services to meet the needs of our residents and factored owners, for example by maintaining accessible accommodation if you are disabled;
6.1.4 It will allow us to provide services which are tailored to your particular needs;
6.1.5 It will be used to improve the services you receive from us, by improving our policies, procedures and our operating model;
6.1.6 It will be used to provide you with welfare benefit advice where appropriate;
6.1.7 It will be used for the arrangement and completion of communal repairs;
6.1.8 It will be used for the fulfilment of our regulatory and legislative requirements, and specifically our obligations in terms of compliance and health and safety;
6.1.9 It will allow us to make contact with you in the most appropriate way. For example, we can provide literature in large print if you have difficulty reading smaller print; or provide documents in an alternative language if English is not your preferred language; and
6.1.10 It will be used to report anonymously to our key internal stakeholders to ensure that our services are inclusive, meet peoples’ needs and are not discriminatory. For example, by reviewing anonymous customer complaints by age or disability we can ensure that certain groups of tenants are not disproportionately dissatisfied with our service, or subject to discrimination.
6.2 An understanding of your personal situation and individual needs will allow us to provide a tailored service that meets any physical, cultural or financial needs that you may have.
6.3 In circumstances where we may wish to use your personal data to help us improve our services for you (including, but not limited to, involvement in our satisfaction surveys), we will explicitly seek your consent.
7. What is the legal basis for using your information?
7.1 In accordance with the data protection laws, we need a "legal basis" for collecting and using information about you. There are a variety of different legal basis for processing personal data which are set out in the data protection laws.
7.2 The legal basis on which we rely in order to use non-sensitive information which we collect about you for the purposes set out in this notice will be either:
7.2.1 that it is necessary in order for us o perform factoring services in respect to your property;
7.2.2 that it is necessary for us to comply with a legal obligation to which we are subject (for example, reporting suspected fraud); and
7.2.3 that you have provided consent to our use of your information where the purpose is not directly related to factoring services provided (see paragraphs 5.2 and 6.3 above).
7.3 The legal basis on which we rely, in order to use your special categories of personal data which we collect about you (sensitive data such as disability data), will be that it is necessary for us to assess your particular factoring needs, so that we can comply with our obligations under social protection law and as a registered social landlord.
7.4 The legal basis on which we rely, in order to use your special categories of personal data (consent based information such as race, ethnicity, sex, sexual orientation, gender re-assignment), will be that you have provided explicit consent to our use of your information for that purpose, so that Sanctuary can ensure that our services are inclusive, accessible and non-discriminatory, and to allow us to meet regulatory reporting requirements where applicable.
7.5 We may also from time to time rely on the legal basis of protecting someone’s vital interests or substantial public interest to collect or share information, where we have safeguarding or child protection concerns, or feel we must report a health crisis or incident to social services, the emergency services or other support and regulatory agencies.
7.6 The legal basis on which we rely, in order to use information on your personal and financial circumstances to provide welfare benefit advice will be that you have provided explicit consent to our use of your information for that purpose, so that Sanctuary can provide tailored services to you to you to help you to manage your factoring account.
8 Sharing your information
Members of Sanctuary Group
8.1 Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary in order to best provide factoring services to you.
8.2 Your information will only be accessed by other companies in the Group where it is necessary to do so in order to provide factoring services to you. The obligations which are set out in this notice shall apply to the other members of the Group to the same extent that they apply to us.
8.3 For more information on which companies make up Sanctuary Group, please go to www.sanctuary.co.uk/about-sanctuary.
Contractors and sub-contractors
8.4 It may be necessary to share information about you with our contractors and sub-contractors in order to provide you with factoring services. This may include your contact details as well as information about any health condition or specific needs you may have. We will only share information about you with contractors and sub-contractors which is relevant and necessary to address your individual needs and/or to maintain the safety of contractor personnel during home visits. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and / or the UK GDPR (as applicable).
8.5 Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
Regulators and other legal obligations
8.6 We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
8.7 We may from time to time share your information with other organisations where this is legally permitted, including, but not limited to:
8.7.1 the police for the purpose of detection and prevention of crime;
8.7.2 organisations such as local government, with a function of auditing and / or administering public funds for the purpose of detection and prevention of fraud or reduction of homelessness;
8.7.3 regulatory, statutory and / or voluntary bodies with a function of providing support and social care;
8.7.4 court services in relation to formal enforcement action;
8.7.5 individuals or organisations who have been granted third party authority or power of attorney;
8.7.6 third parties who manage properties on your behalf, for example a property management company or letting agent to deliver factoring services. This will only occur when Sanctuary has obtained written consent from you first.
9. Transferring your information abroad
9.1 We use a third party processor, Campaign Monitor, for some of our email campaigns and we transfer your information to Campaign Monitor for the purpose of sending e-marketing and communication emails to you. Campaign Monitor is a global business that is headquartered in Australia and uses a data centre located in the United States of America, so their processing of your personal data will involve a transfer of data outside the UK.
9.2 Whenever we transfer your personal data out of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that we rely on an adequacy decision and/or use specific contract clauses which give personal data that same protection it has under UK law.
9.3 Please contact us if you want further information on the specific mechanism used by us when transferring your personal data outside of the UK.
10. Security of your information
10.1 The information that you provide will be stored securely on our systems. Our security measures and procedures reflect the seriousness with which we approach security and the value we attach to your information.
10.2 Only relevant members of staff will access the information you provide to us.
11. Can we use your information for any other purpose?
11.1 In limited circumstances we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
12. Storing your information and deleting it
12.1 We will store the personal data which you provide to us for as long as you remain in receipt of factoring services, and in accordance with the provisions of our Records Management Policy and relevant retention schedules.
12.2 Once you are no longer in receipt of factoring services, we will review the information which we hold concerning you and determine whether there are any reasons why we need to continue holding that information. For example, if you owe Sanctuary money for factoring services after you have sold your property, it may be necessary to retain certain information about you in order to recover those arrears. Once the identified purpose comes to an end, unless there is another identifiable purpose for which it is necessary to hold on to your information, we will delete it or destroy it securely.
13. Your rights
13.1 In relation to the information which we hold about you, you are entitled to:
13.1.1 Ask us for access to the information;
13.1.2 Ask us to rectify the information where it is inaccurate or is incomplete;
13.1.3 Ask us to erase the information, and take steps to ask others with whom we have shared your information, to erase it
13.1.4 Ask us to limit what we do with your information;
13.1.5 Object to our use of your information and ask us to stop that use;
13.1.6 Instruct us to provide you with the information we hold about you in a structured and commonly used format or transmit that information directly to another organisation (for example, if you want the information to be sent to a solicitor or mortgage provider).
13.2 Our obligations to comply with the above rights are subject to certain exemptions.
13.3 Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected.
13.4 To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
13.5 You also have the right to complain to the Information Commissioner's Office (ICO) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.