On this page
For more information on what data we collect as Swan Housing Association Limited, a part of Sanctuary Group (“Sanctuary”), how we use it, how long we keep it and when we may share it, please see our Swan Housing Association Privacy Statement.
Who are we?
We are Sanctuary Housing Association, a part of Sanctuary Group (“Sanctuary”), one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
What we do (processing activities)
Why are we collecting your information?
Basic application information
The information that you provide to us on the form(s) relating to your application is required by Sanctuary in order for us to assess your need for housing. This will include basic identifier information about you and other members of your household, contact details, and information about any relevant health conditions or specific needs that our staff should be aware of when processing your application. We need to collect this information because without it we will not be able to enter into a contract with you.
Account management information
If you are offered a tenancy, Sanctuary may invite you to answer some questions on your personal and financial circumstances for use in our Account Management Process.
This information will be used to complete our Account Management Process, which will allow Sanctuary to offer tailored services related to your rent account.
Equality and diversity information
Before or during your tenancy Sanctuary may invite you to share data on your diversity characteristics.
This is voluntary, and we ask for this data for reasons including, an ambition to improve our services and to comply with external reporting requirements.
Collecting equalities data is also part of Sanctuary’s Equality Strategy: Inclusion for All and is therefore a core element of governance and making sure that we listen and respond to your needs, promote your interests and enhance trust within our community. This can include making reasonable adjustments in specific circumstances to ensure a particular applicant’s support needs or accessibility requirements are respected and met, or it can mean implementing positive action initiatives and using data to improve our policies, procedures and services more generally.
Sanctuary also collects and uses data on characteristics such as ethnicity, disability and gender re-assignment to protect people from unlawful discrimination and it is a requirement of the Regulator of Social Housing to record and report the diversity characteristics of applicants and tenants where this information has been provided to us.
Some of the information we collect is provided by a third party such as your current or previous landlord, support services, local authorities, or health professionals where they are legally entitled to share this information with us.
What information are we collecting?
We currently collect and process the following information:
- Name
- Contact Details
- Date of Birth
- Household Member Details
- Financial / Benefits Information
- Tenancy Data
- Gender
- Personal circumstances and lifestyle details i.e., vulnerabilities/support requirements, reason for moving, pet details, proof of pregnancy (if applicable)
- Signature
- ID Documentation
- Occupation Details
- Immigration Status
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Criminal Convictions and Offences Data
- Equality / Diversity data
- Health / Disability data
- Racial or ethnic origin
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(b) Performance of contract
(c) Compliance with a legal obligation.
(f) Our legitimate interests or that of a third party.
In accordance with Article 9 (UK GDPR) the conditions we rely on for processing special categories of personal data are:
(b) Employment, social security and social protection law
(g) Reasons of substantial public interest.
Our basis in Law is Section 8 of Schedule 1, of the Data Protection Act 2018.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations where this is lawfully permitted including, but not limited to:
- Home Office
- Other Housing Associations
- Local Authorities
- Health Professionals
Data processors and Transfers
When your application includes consideration of any health or disability related matters, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Occupational therapists
We also use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
If your application is unsuccessful or cancelled your information will be retained for six months following the outcome.
If you take up a tenancy with Sanctuary, we will retain your information for six years following the end date of your tenancy.
Why are we collecting your information?
Basic tenancy information
The information that you provide to us during the course of your tenancy is required by Sanctuary in order for us to provide you with our basic services under your tenancy agreement. This will include basic identifier information about you and other members of your household, contact details, and information about any relevant health conditions or specific needs that our staff should be aware of when performing housing and maintenance services for you. We need to collect this information because without it we will not be able to enter into or maintain a contract with you.
Account management information
Before or during your tenancy, Sanctuary may invite you to answer some questions on your personal and financial circumstances for use in our Account Management Process.
This information will be used to complete our Account Management Process, which will allow Sanctuary to offer tailored services related to your rent account.
Equality and diversity information
Before or during your tenancy Sanctuary may invite you to share data on your diversity characteristics.
This is voluntary and we ask for this data to improve our services and to comply with external reporting requirements.
Collecting equalities data is also part of Sanctuary’s Equality Strategy: Inclusion for All and is therefore a core element of governance and making sure that we listen and respond to your needs, promote your interests and enhance trust within our community. This can include making reasonable adjustments in specific circumstances to ensure a particular applicant’s support needs or accessibility requirements are respected and met, or it can mean implementing positive action initiatives and using the data we collect to improve our policies, procedures and services more generally.
Sanctuary also collects and uses data on characteristics such as ethnicity, disability and gender re-assignment to protect people from unlawful discrimination and it is a requirement of the Regulator of Social Housing to record and report the diversity characteristics of tenants where this information has been provided to us.
In certain scenarios we may also receive information about you from a third party such as support services, the police, local authorities or health professionals where they have an appropriate legal basis for sharing your information.
Purposes your information will be used for
- It will allow us to comply with our legal duty to make reasonable adjustments to our services to meet the needs of our residents, for example by providing accessible accommodation if you are disabled;
- It will allow us to provide services which are tailored to your particular needs, for example by providing translators at appointments or meetings where English is not your preferred language;
- It will be used to improve the services you receive from us, by improving our policies, procedures and our operating model;
- It will be used to support you to effectively manage and sustain your tenancy, including, but not limited to: housing management to ensure compliance with the terms of your contract with us, management of antisocial behaviour;
- It will be used to provide you with welfare benefit advice;
- It will be used for the arrangement and completion of repairs;
- It will be used for the fulfilment of our regulatory and legislative requirements, and specifically our obligations in terms of compliance and health and safety;
- It will allow us to make contact with you in the most appropriate way. For example, we can provide literature in large print if you have difficulty reading smaller print; or provide documents in an alternative language if English is not your preferred language; and
- It will be used to report anonymously to our key internal stakeholders to ensure that our services are inclusive, meet peoples’ needs and are not discriminatory. For example, by reviewing anonymous customer complaints by age or disability we can ensure that certain groups of tenants are not disproportionately dissatisfied with our service, or subject to discrimination.
- An understanding of your personal situation and individual needs will help us to provide a tailored service that meets any physical, cultural or financial needs that you may have.
- To provide support in applying for a TV licence where requested.
In circumstances where we may wish to use your personal data to help us improve our services for you (including, but not limited to, involvement in our resident scrutiny processes), we will seek your consent.
What information are we collecting?
We currently collect and process the following information where applicable:
- Name
- Age / Date of birth
- Contact details
- Next of kin details
- Household details
- Occupation
- Financial / Benefit Information
- Rent – related documents
- ID documentation
- Gender
- Antisocial behaviour details (where applicable)
- Tenancy matters and breaches
- Marital status
- Personal circumstances, preferences and lifestyle details e.g. vulnerabilities/support requirements, reason for name change, reason for leaving previous property, pet details, proof of pregnancy (where applicable)
- Signature
- Immigration / right to rent status
- Personal opinions / exit survey – following the end of your tenancy.
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Criminal Convictions / Offence Data / Court Orders
- Equality / Diversity data
- Health / Disability data
- Racial or ethnic origin
- Sexual Orientation
Some of the information we collect is provided by a third party where they are legally entitled to share this data with us, including :
- Local authorities
- Current and previous landlords
- Support agencies
- Police / Emergency Services
- Home Office
- Department for Work and Pensions (DWP) - Universal Credit
- Health professionals
If you don’t provide the information listed above, we may not be able to enter into a contract with you or provide you with the full range of services on offer which will limit the support we can give.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(b) Performance of a contract
(c) Compliance with a legal obligation
(f) Our legitimate interests or that of a third party.
In accordance with Article 9 (UK GDPR) the conditions we rely on for processing special categories of personal data are:
(b) Employment, social security and social protection
(f) Legal claims or judicial acts
(g) Reasons of substantial public interest.
Our bases in Law for the above processing are Section 1, 8 and 10 of Schedule 1, of the Data Protection Act 2018.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
Your information will only be accessed by other companies in the Group where it is necessary to do so in order to provide services to you in accordance with our contract. The obligations which are set out in this notice shall apply to the other members of the Group to the same extent that they apply to us.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, where this is legally permitted, including, but not limited to:
- Utility companies so they can provide services to you and contact you in respect of utility charges;
- The police for the purpose of detection and prevention of crime;
- Organisations such as local government, with a function of auditing and / or administering public funds for the purpose of detection and prevention of fraud or reduction of homelessness;
- Regulatory, statutory and / or voluntary bodies with a function of providing support and social care;
- Court services in relation to formal tenancy enforcement action;
- Public Trustee in relation to the termination of a tenancy where there is no next of kin or Executor;
- Individuals or organisations who have been granted third party authority or power of attorney;
- Property management companies to deliver services in keeping with the specific terms of the housing management contract.
- Local authority teams where this is necessary in relation to our responsibilities to you as a landlord, such as environmental health.
- If requested, we will share your information with TV Licensing or the Post Office in order to set up a TV licence for you.
Hardship funds
We will share your first and last name, email address and telephone number with e-vouchers for the purpose of providing you with vouchers that you can redeem towards your energy bill or for cash.
Data Processors - Contractors and sub-contractors
To facilitate the delivery of our services, it may be necessary to share information about you with our contractors and sub-contractors.
We will only share your information where it is relevant and necessary. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on our behalf.
We use the following categories of data processors:
- Maintenance contractors
- Communications and Messaging service providers
- Environmental and community safety providers
Data Transfers
We also use a third-party processor for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law. Once you are no longer a resident of ours your information will be retained for six years following the end of your tenancy.
Why are we collecting your information?
To facilitate your booking of a communal and / or guest room at one of our Housing for Older People Schemes.
What information are we collecting?
We currently collect and process the following information:
Communal Room Hire:
- Name of hirer
- Position held within organisation (charitable/welfare groups) if applicable
- Telephone number
- Email address
- Signature
- Financial / payment information if applicable
Guest Room Hire:
- Resident name and address visiting
- Dates of stay
- Visitor name, address, contact number and email address
- Financial / payment information
- Reason for stay
- Resident and visitor signature
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(b) Performance of a contract.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We will keep information relating to your booking for six years following your stay or room hire.
Why are we collecting your information?
Sanctuary uses Video Surveillance Management Systems (commonly known as CCTV) to help reduce the fear or threat of crime, to protect customers, staff, our premises, fixtures, fittings, and property.
Video surveillance images will be used to:
- Assist in the prevention and detection of crime
- Facilitate the identification, apprehension and prosecution of offenders in relation to crime;
- Ensure the security of the Group’s customers, employees, visitors and property;
- Facilitate appropriate door and site access;
- Reduce incidences of vandalism and criminal damage; and
- Enhance the feeling of security provided to customers, staff, and visitors.
What information are we collecting?
We collect and process video surveillance images. These images may reveal or enable the inference of special categories of data (also called sensitive personal data), such as any disability or health conditions, racial or ethnic origin as well as religious beliefs.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(f) Our legitimate interests or that of a third party – for the purposes of prevention and detection of crime.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(g) Reasons of substantial public interest.
Our basis in Law is Section 10 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of the prevention or detection of an unlawful act.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- Insurance companies or solicitors, in connection with any claims where evidence of video surveillance footage is required.
Data processors and transfers
To facilitate this process, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Security companies that are responsible for on-site security (where applicable).
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We retain video surveillance footage for 28 days at which point the information is automatically deleted.
Why are we collecting your information?
We process your information so that we can keep you updated with relevant news, events and information emails about Sanctuary and the services we provide.
With your consent, we’ll send you appropriate marketing emails.
You can unsubscribe from our emails at any time.
What information are we collecting?
We process your name and email address.
We will also collect information about how you interact with those emails; whether you open them or not, at what time, if you mark them as spam, whether you click on a link and whether you unsubscribe.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information is:
(a) You have given your consent. You can remove your consent at any time, by contacting online.marketing@sanctuary.co.uk.
(f) Legitimate interests – to keep you updated about relevant news, events and information emails regarding Sanctuary and the services we provide.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
We use a cloud-based email distribution platform, which stores data on severs located in the United States of America. This constitutes a ‘restricted transfer’ under data protection law and is made in accordance with Article 45 of the UK GDPR as the processing is covered by UK-US data bridge.
For further information regarding the UK-US data bridge please see the Government’s Department for Science, Innovation & Technology website.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We will store the personal data which you provide to us for as long as our products or services match the interest you expressed and for as long as you continue to provide consent.
Why are we collecting your information?
Information you provide to us is voluntary and will be used to support our communication and marketing activities. This may include promotional materials, press releases, social media posts, case studies and corporate documents.
Our materials may be published internally within Sanctuary as well as externally to our residents, on our social media channels and our websites.
What information are we collecting?
We currently collect and process the following information:
- Name
- Age/Date of birth
- Contact details including your email, phone number and your address; and
- Photos, videos or audio recordings (if applicable)
- Personal experiences (if applicable)
If you choose to provide it, some of the information which we collect may be special categories of personal data (also called sensitive personal data), which includes the following information:
- Health-related information, including disability
- Sexual orientation
- Racial or ethnic origin; and
- Religious beliefs
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(a) You have given your consent. You can remove your consent at any time by contacting communications@sanctuary-housing.co.uk.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(b) Explicit consent
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate our marketing and communication activities.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Contractors and sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors, for example with an external design, website or digital agency, when creating our marketing materials. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
With your consent we may from time to time share your images and information provided with our partners to support our communication and marketing activities.
Data processors and Transfers
To facilitate our communication and marketing activities, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Photographers and videographers;
- Website and digital agencies;
- Marketing and PR agencies;
- Media organisations;
- Printing companies;
- System providers (in circumstances of technical IT support)
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We will retain the information you provide for 5 years, unless you contact us to withdraw consent earlier than this date.
We may from time to time seek to ‘refresh’ your consent, at which point we would retain your information for a further 5 years from the date consent was refreshed.
Why are we collecting your information?
Data protection laws aim to empower individuals and give them greater control over their personal data through several rights including:
- Right of access – referred to by the Group as a DSAR (Data Subject Access Request), gives individuals the right to obtain a copy of their personal data from us, as well as other supplementary information.
- Right to rectification – to have inaccurate personal data rectified, or completed if it is incomplete. This right is not absolute and in certain circumstances the Group can refuse a rectification request.
- Right to erasure – the right to have their personal data erased. This right is not absolute and in certain circumstances the Group can refuse an erasure request.
- Right to restrict processing – to restrict the processing of their personal data. For example, Sanctuary could continue to store personal data but not use it. This right is not absolute and in certain circumstances the Group can refuse a request.
- Right to data portability – to obtain and reuse their personal data for their own purposes across different services. The right only applies to information an individual has provided to Sanctuary and where the lawful basis for processing is consent or performance of a contract. Paper records are excluded from this right.
- Right to object – the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing. The right effectively allows individuals to stop or prevent organisations from processing their personal data, though is not absolute and in certain circumstances the Group does not have to comply.
- Rights related to automated decision making and profiling – restricts organisations from making solely automated decisions, by enabling individuals to request human intervention or challenge a decision that has been made.
Sanctuary Group is committed to protecting the rights of data subjects and ensuring compliance with all applicable data protection laws in the UK. The information we collect, and process will be used to administer your data subject rights request.
What information are we collecting?
To facilitate your request, we will collect and process the following information:
- Name
- Contact details, such as address, email address and telephone number
- Identification documentation
- Details of the scope of request
- Third party authority data (where applicable)
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(c) Compliance with a legal obligation – using your information is necessary for us to comply with a legal obligation to which we are subject in accordance with UK data protection law.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate your request.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them, for example if you raise a complaint with the Information Commissioners Office about the handling of your request.
Other organisations
We may share your information with other organisations where relevant in order to comply with your request of erasure, restriction, objection or rectification where we had previously shared that information with our partner organisations.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Following completion of your request or any subsequent complaint to the Information Commissioner's Office, the case file will be retained for one year before deletion.
Why are we collecting your information?
To enable customers, residents and the public to raise enquiries and/or seek information about our services.
If your enquiry relates to a service failure, the information that you provide will also be used for the purpose of improving our products and services.
What information are we collecting?
The information that we collect about you will include your name and contact details, and any other information which you provide to us via email, social media message, telephone, live chat or by completing an enquiry form from our website.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(f) Our legitimate interests or that of a third party in enabling residents and the public to engage with Sanctuary on the services available, seek information and /or support.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to answer or resolve your query.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Contractors and sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors to resolve your enquiry, for example if you report a fault and require a repair. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
To facilitate enquires through our website and social media channels the following categories of data processors may process information on Sanctuary’s behalf when providing technical IT support:
- Website hosting partner
- Software providers
We use a cloud-based social media aggregator platform to manage direct messages sent to our social media accounts. Technical support for the platform is based in Canda and the delivery of these services may involve a ‘restricted transfer’ under data protection law. Any transfer is made in accordance with Article 45 of the UK GDPR as Canda is deemed an ‘adequate’ country by the UK Government.
The platform also uses servers located in the United States of America to store information. This processing also constitutes a ‘restricted transfer’ under data protection law and is also made in accordance with Article 45 of the UK GDPR as the processing is in accordance with the UK-US data bridge.
Storing your information and deleting it
Following resolution of your enquiry, your information will be retained as outlined below:
- Web forms submitted via our websites are retained for 30 days.
- Social media private messages are retained for two weeks.
- Emails are retained for a minimum of one year and are automatically deleted after three years.
- Telephone recordings are retained for 30 days. Please note not all telephone calls are recorded.
Automated decision making
An automated decision is a decision made by a computer without any human involvement in the process. We will not use automated decision making in relation to processes that would have legal or similarly significant effects.
We may, however, use automated decision making of your personal data whenever you send an email to our Repairs Customer Hub, as we currently use an email prioritisation tool that priorities emails depending on their level of urgency. Although automated decision making is used to manage the emails, there is still human intervention as staff carry out a review of the email prioritisation on a daily basis.
Why are we collecting your information?
We are required to contact you to seek your views about our services to fulfil the requirements of the Regulator of Social Housing consumer standards in England.
We will also seek your views to improve our service provision more widely.
The information you provide to us will be used for the following purposes:
- Data provided will be used to comply with the requirements of the Regulator of Social Housing consumer standards in England (for Tenant Satisfaction Measures). Any information shared will be anonymised.
- To identify service failure and improve our services more widely. Information may be passported to other parts of Sanctuary to address the specific service failure identified.
- Creating broad customer profiles to provide the most effective service based upon need.
What information are we collecting?
The information we collect is about your views of our service, in some cases when you have directly experienced them e.g. when we have done a repair at your home, how satisfied you are and why.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(c) Compliance with a legal obligation (for example, the Regulator of Social Housing consumer standards);
(f) Our legitimate interests or that of a third party in addressing a specific service failure or improving our services more widely.
Sharing your information
Members of Sanctuary Group
Sanctuary is made up of several related companies. We will share your information with other members of the Group where necessary to address a specific service failure.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Data Processors and Transfers
This process is supported and facilitated by an appointed market research contractor, which we require to comply with the Data Protection Act 2018, UK GDPR and the Market Research Society standards.
Our contractor will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
We will not be transferring your information abroad for this purpose. All information will be held in the UK.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Information related to tenant satisfaction surveys will be retained for 3 years following completion of the survey.
Why are we collecting your information?
Sanctuary aims to provide good quality homes and to deliver high quality services. To understand how we are doing and where we could make improvements, we would like to seek your experiences of our services.
Where applicable your information will also be used for processing expense claims.
Information may be passported to other parts of Sanctuary to address any specific service failures identified.
What information are we collecting?
The information we collect is about your experience of our service, which may include how satisfied you are and why.
To facilitate this, we may process the following information:
- Name
- Address
- Contact details
- Age
- Financial details
- Tenure type
- Gender
To monitor and ensure the equality of our services we may also process special categories of personal data (also called sensitive personal data), including:
- Ethnicity
- Health and Disability
- Sexual orientation
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(a) You have given your consent. You can remove your consent at any time. You can do this by contacting scrutiny@sanctuary.co.uk.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(g) Reasons of substantial public interest.
Our basis in Law is Section 8 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the equality of opportunity and treatment.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to improve the services we provide and to address a specific service failure if applicable.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
We may use a third-party experience management platform to facilitate some of our customer experience surveys. This platform is supported by the software provider who we may share your information with for the purposes of providing technical IT support to address system issues.
We also use a third-party processor for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Responses to customer engagement activities may be retained for up to 3 years following participation.
Why are we collecting your information?
Understanding your needs is crucial for us to be able to tailor our services for you. The data we collect through Sanctuary Census is to make sure we have an up to date understanding of you so we can do this effectively, supported by the creation of broad customer profiles to provide the most effective service based upon need.
Where issues of service failure are identified during this process this information will be used to address the issue as well as improve our services more widely.
What information are we collecting?
The information we collect is about you and others who live in your home. We will collect and process the following information:
- Contact details and how you prefer us to contact you
We will additionally collect and process the following optional information about you and others who live in your home that can be provided on a voluntary basis:
- Gender
- Main language
- Marital status
- Nationality
- Membership of armed forces (if applicable)
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following optional information that can be provided on a voluntary basis:
- Disability and Health
- Race
- Ethnic Origin
- Religious and/or philosophical beliefs
- Sexual Orientation
- Gender reassignment
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(c) Compliance with a legal obligation - as we are subject to the Regulator of Social Housing consumer standards.
(f) Our Legitimate interests or that of a third party – where issues of service failure and opportunities for improvement are identified as well as the creation of broad customer profiles to provide the most effective service.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(d) Not-for-profit bodies.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
To support this process, we use third-party processors who provide the system used to collate the information as well as technical IT support for the systems used to store the information.
Our technical IT support partner may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement (Standard Contractual Clauses) issued by the Information Commissioner’s Office.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Responses will be retained for three years following the closure of the census.
Why are we collecting your information?
Sanctuary aims to provide good quality homes and deliver high quality services. However, it is recognised that there may be times when something goes wrong, or customers are dissatisfied.
The information you provide will be used to process, investigate, and respond to your complaint.
It will also be used to identify service failure and improve our services more widely. Information may be passported to other parts of Sanctuary to address the specific service failure identified.
We may also receive personal information indirectly, from the Housing Ombudsman or your Member of Parliament if you have raised the matter with them, as well as our contractors as part of our investigation.
What information are we collecting?
We collect and process the following information:
- Name
- Contact details
- Complaint details
- Third party authority (if applicable)
- Financial / bank details (if applicable for the payment of a goodwill gesture or compensation).
Depending on the nature of your complaint, some of the information which we collect may be special categories of personal data (also called sensitive personal data), including information relating to your health.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(f) Our legitimate interests or that of a third party, enabling customers to raise a complaint, identify and address failures in service.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(a) Explicit consent.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to investigate and resolve your complaint.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
We may share your information with the Housing Ombudsman if you have raised a complaint with them about Sanctuary to support this process.
Other Organisations
Where issues of service failure have been identified, it may be necessary to share information about you with our contractors and sub-contractors in order to address this, for example where a repair has not been completed or to your satisfaction. We will only share your information about you with contractors and sub-contractors where it is relevant and necessary to address your individual needs.
Data Transfers
We use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Information relating to complaints raised by tenants, will be retained for 6 years following the end of your tenancy.
Complaints raised by members of the public will be retained for 5 years following closure of the complaint.
Financial Information relating to payments of compensation and gestures of goodwill will be retained for 6 years from the end of the last financial year they relate.
Why are we collecting your information?
New Court is a retirement community exclusively for the over 65s. The information that you provide to us will be used to ensure you meet this criteria and provide the services under your contractual agreement with us.
Without this information, we will not be able to enter into a contract with you or provide the full range of services on offer which will limit the support we can give you.
What information are we collecting?
We collect and process the following information:
- Name
- Address
- Contact details
- Date of Birth
- Gender
- Emergency contact details including their relationship to you
- Preferred language
- Financial Information, including direct debit mandate
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Health information, including any serious medical conditions you have, medication details as well as if you receive support from carers.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(b) Performance of a contract
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(a) Explicit consent
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We will not share your information with other organisations without your consent, except in emergency and potentially lifesaving situations.
Data Transfers
We use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law. Once you are no longer a resident of New Court your information will be retained for six years.
Why are we collecting your information?
The information that you provide to us during your sales query and property transaction, in relation to:
Staircasing
License to assign
Surrender and re grant of lease
Redemption of Legal Charge
Lease extensions
Transfers
Assignments
is required for us to meet our legal, regulatory and contractual obligations, including verifying your identity for the purposes of preventing fraud and money laundering.
It will also be used to undertake relevant compliance activities such as updating deed of covenant, certificate of compliance, compliance with terms of the transfer/lease and compliance with restrictions on title.
We will also collect information based on any further correspondence we have with you once you have purchased your property and to facilitate any on-going services provided by Sanctuary to you, such as but not limited to remedying defects, repairs and maintenance of communal areas, the collection of fees such as service charges, rent due on the remaining un-purchased equity.
We may also receive personal information indirectly in certain circumstances from estate agents, appointed solicitors, mortgage brokers and any third party with authority.
Without this information, we will not be able to enter a contract with you.
What information are we collecting?
We may collect and process the following information:
Name
Contact Details
Address,
Date of Birth
National Insurance Number
Identification Documents
Income Details
Employer Details (if applicable)
Current Mortgage Details
Financial Details (Bank details, benefits information, bankruptcy information, monthly expenditure, debts (if applicable))
Loan / Credit Agreement information (if applicable)
Details of other properties owned (if applicable)
Debt information for example County Court Judgements (if applicable)
Household member details, including date of birth, gender, name, benefits information, relationship to applicant (if applicable)
Relationship to staff or committee member (if applicable)
Local connection and associated family details (if applicable)
Signature
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
Health Data, including members of your household (if applicable)
Where applicable, if you do not provide this information to us, we will not be able to process your property purchase.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
Performance of a contract
Compliance with a legal obligation
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
- Employment, social security and social protection law
- Archiving, research and statistics
Our basis in Law is Section 1 and 4, of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for social security and protection, archiving, research or statistical purposes.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About us.
Contractors and Sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors, such as sales agents, appointed estate agents, solicitors, and mortgage brokers, to provide you with the services in accordance with the contract between us. We will only share information about you with the contractors and sub-contractors which is relevant and necessary. The contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by data protection legislation.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
Homes England, Greater London Authority, as part of our auditing requirements and contractual obligations.
Appointed solicitors, surveyors and mortgage brokers and lenders who will be acting on your behalf through the sale process.
The Department for Levelling Up, Housing & Communities (DLUHC) for research and statistical purposes only. The information is provided via ‘Submit social housing lettings and sales data (CORE)’, a service funded and managed by DLUHC.
It collects information on the leaseholders or sale, and the dwelling itself. Some of this data is personal and sensitive, so DLUHC is responsible for ensuring it’s processed in line with data protection legislation.
Further information can be found via DLUHC’s website - www.gov.uk/government/collections/rents-lettings-and-tenancies.
Information collected via CORE is shared with other government departments and agencies. It’s shared with the Greater London Authority and the Regulator of Social Housing. Data providers can also access data for their organisations via CORE. Data is only shared for research and statistical purposes.
Data Transfers
We may use DocuSign to facilitate the signing of documents. DocuSign are a global company who may transfer your personal information outside of the European Economic Area for further processing.
DocuSign has adopted Binding Corporate Rules to facilitate the transfer of personal information from the EEA to DocuSign outside of the EEA. You may view DocuSigns Binding Corporate Rules at www.docusign.com/trust/privacy/binding-corporate-rules.
We also use a third-party processor for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented please email dataprotection@sanctuary.co.uk.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We will keep your information for 6 years from the date of completion of your property transaction.
Why are we collecting your information?
The information that you provide to us on your application form and in any supporting documentation is required by Sanctuary for us to determine your eligibility for one or more of our property ‘buying schemes’ (Preserved Right to Buy, Right to Acquire and Voluntary Sales Policy). Without this information, we will not be able to progress your application.
Upon completion of any sale your information (where applicable) will be used in connection with any ongoing landlord and tenant relationship and for estate management purposes.
It will allow us to contact you (where applicable) in connection with any ongoing landlord and tenant relationship and for estate management purposes;
It will allow us to process your Right to Buy application;
It will be used to assess customer’s source of funds in readiness for completion;
It will be used to undertake relevant compliance activities such as updating deed of covenant, certificate of compliance, compliance with terms of the transfer/lease and compliance with restrictions on title;
It will allow us to provide services which are tailored to your needs; and to make contact with you in the most appropriate way. For example, we can provide literature in large print or provide documents in an alternative language to English.
We may also receive further information from third parties (e.g. Local authorities and Housing Associations) as part of our legal obligations which will be relevant to assessing your eligibility.
What information are we collecting?
The only information which we are collecting about you is the information which you provide to us in and accompanying your application.
We currently collect and process the following information:
Name
Contact details
Identification documentation
Address evidence documentation
Financial information (inc. income details) and supporting evidence
Credit and loan agreements
Mortgage offer
Bank account and savings account details.
Source of funds
Property address details
Pension statements
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
Performance of a contract
Compliance with a legal obligation - to comply with our obligations in accordance with the Housing Act 1985 and the Housing (Right to Acquire) Regulations 1997.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to assess and progress your application.
For more information on which companies make up Sanctuary Group, please go to About us
Contractors and sub-contractors
It may be necessary to share information about you with our contractors and sub-contractors to facilitate the assessment and progress your application. For example, this may include external property surveyors and Energy Performance Certificate contractors.
Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
The Department for Levelling Up, Housing & Communities (DLUHC) for research and statistical purposes only. The information is provided via ‘Submit social housing lettings and sales data (CORE)’, a service funded and managed by DLUHC.
It collects information on the leaseholders or sale, and the dwelling itself. Some of this data is personal and sensitive, so DLUHC is responsible for ensuring it’s processed in line with data protection legislation.
Further information can be found via DLUHC’s website - www.gov.uk/government/collections/rents-lettings-and-tenancies.
Information collected via CORE is shared with other government departments and agencies. It’s shared with the Greater London Authority and the Regulator of Social Housing. Data providers can also access data for their organisations via CORE. Data is only shared for research and statistical purposes.
Local Authorities to confirm time spent with a registered provider to support discount entitlement and council tax purposes.
the police for the purpose of detection and prevention of crime; and
organisations with a function of auditing and / or administering public funds for the purpose of detection and prevention of fraud.
our solicitors for the purpose of progressing and completing any legal transaction with you.
Land Registry at pre-completion and post-completion transactions for the property to rectify title requisitions.
Homes England at post-completion transaction for the property to prevent and detect fraud, as we must protect the public funds we handle;
External mortgage brokers to complete financial affordability assessments on our behalf
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We will keep the information that relating to your application and sale (if applicable) for 10 years.
Why are we collecting your information?
To process and administer your Housing Condition Claim, including communication with your solicitor as well as to facilitate repair work.
This will include information collected and processed as part of the management of your tenancy. In some instances, the information we process in relation to your claim will be provided directly by you or your representative(s).
What information are we collecting?
To process your Housing Condition Claim we may process the following information:
Name
Address
Contact details
Additionally, we will process information relating to the condition of the property that the claim relates to.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
Compliance with a legal obligation - using your information is necessary for us to comply with a legal obligation to which we are subject, which is dictated by court orders, civil procedure rules and general litigation rules for disclosure requirements.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
Legal claims or judicial acts
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to process your claim.
For more information on which companies make up Sanctuary Group, please go to About us.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
HM Courts and Tribunal Service
Your solicitor
Single Joint Expert Witness
The Housing Ombudsman
Data processors and Transfers
To facilitate the Housing Condition Claim process, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
Expert witnesses
Legal partners, including Solicitors and Barristers
Process Servers
Insurers
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We keep information relating to your Housing Conditions Claim for 6 years from the date of conclusion of the matter.
Why are we collecting your information?
We process your information in order to understand our residents and offer a Person Centred Fire Risk Assessment to mitigate risk in the event of a fire
What information are we collecting?
We currently collect and process the following information:
Name
Home Address
Email Address
Phone number
Date of Birth
Gender
Health / Disability data
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Health / Disability data
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
Compliance with a legal obligation.
Performance of a task carried out in the public interest.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
Reasons of substantial public interest
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to www.sanctuary.co.uk/about-sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
Fire and Rescue Service
Data processors
To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf.
For further information on the safeguards implemented, please email dataprotection@sanctuary.co.uk.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association, a part of Sanctuary Group (“Sanctuary”) one of the UK's leading providers of housing, care and
commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
Litigation information
Most of the personal information we process in relation to housing litigation is information collected and processed as part of the management of your tenancy. In some instances, the information we process in relation to housing litigation will be provided directly by you or your representative(s). We process this data for one of the following reasons:
- Support with tenancy management related queries and problems;
- Providing assistance with interpreting any of the Group’s tenancy agreements;
- Instigate and defend claims on behalf of the Group;
- Possession proceedings
- Injunction proceedings
We may also receive personal information indirectly, from the following sources in the certain circumstances:
- Third parties
- Sanctuary staff
- Third party agencies
Your other personal data
We will also process personal data that we already hold for you to process housing litigation. This will include information that you have provided when entering into a relationship with Sanctuary or that is collected during your relationship with Sanctuary and is covered by a different privacy statement.
Purposes your information will be used for
It will be used to handle claims for internal litigation.
It will be used to issue claims and defences to claims.
It will be used to provide instructions to an expert witness.
It will be used for witness statements as to prepare evidence.
It will be used for compliance with court instruction through court orders or
other reason.
What information are we collecting?
The only information which we are collecting about you is the information which you or a third party provide to us to handle any housing litigation queries, claims or instruction requests. This information might include, but is not limited to, your name, contact details, gender, age, financial information and photos/video recordings.
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Health related information
- Disability
- Ethnicity
- Sexual orientation
- Criminal offence data
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(c) Compliance with a legal obligation - using your information is necessary for us to comply with a legal obligation to which we are subject, which is dictated by court orders, civil procedure rules and general litigation rules for disclosure requirements.
(f) Our legitimate interests or that of a third party.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(f) Legal claims or judicial acts.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- The Courts
- Local authorities
- Police
- The Housing Ombudsman
- Third party agencies
Data processors and Transfers
To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- Providers of our legal services
- Barristers
- Process servers
- Expert witnesses
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
- We keep the information outlined in section five of this notice for 6 years from the date of conclusion of the matter following the purpose it was used for.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association and its wholly owned subsidiaries, together Sanctuary Group (“Sanctuary”) one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
Sanctuary’s award-winning apprenticeship programme offers apprentices and staff the chance to study for a practical qualification while contributing to the success of a fast-paced, constantly evolving organisation.
An apprenticeship is a programme of learning that takes place in the work environment and depending on the programme, at college, where a learner will gain experience and skills in their chosen sector.
The information that is provided to us during the course of the apprenticeship recruitment process is required by Sanctuary in order for us to determine if you are eligible to undertake an apprenticeship programme. Without this information, we will not be able to offer and enter into an apprenticeship contract with you.
We may also receive personal information indirectly, from the following sources in the certain circumstances:
- Learning providers – to provide updates on progress of qualifications and to support the sign-up process
What information are we collecting?
During the apprenticeship recruitment process we will collect and process the following information:
- Name and contact details
- Date of birth
- Nationality
- Gender
- Unique learner number
- Qualifications
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Ethnicity
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(b) Performance of a contract.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(b) Employment, social security and social protection
Our basis in Law is Section 1(a) of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- Learning provider to identify learner and support the sign-up process
- Digital Apprenticeship Service to receive learner details of new apprentices
We use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
We keep the information outlined in section five of this notice for six years following the end of your apprenticeship.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association and its wholly owned subsidiaries, together Sanctuary Group (“Sanctuary”) one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
The information that is provided to us during your appointment (including that obtained as part of the recruitment process), or whilst you are engaged by us as an employee, contractor or worker is required by Sanctuary for us to enter into and perform a contract of employment or services with you. Without this information, we will not be able to offer and enter a contract with you.
The information you provide to us will be used for the following purposes:
- managing your appointment and employment with us, including the performance of our obligations and exercise our rights under your contract of employment or service with us;
- it will allow us to provide services and facilities which are tailored to your needs;
- monitoring and compliance purposes in line with our legal obligations (including our legal obligations as an employer);
- monitor your business and personal use of our information and communication systems to ensure compliance with our Acceptable Usage Policy and Procedure. This includes login and logoff times and any emails or other communications you send or receive in the course of your duties;
- it will allow us to ensure information and network security, including preventing unauthorised access to our computer and electronic communication systems and preventing malicious software distribution;
- collect health information as part of the new starter process and when required to ensure the health and safety of all of our staff and residents. For example,
o we may ask you about any disabilities you have, so that we can make reasonable adjustments to assist you in your role
o during or after a period of illness we may ask for information as part of a return-to-work assessment
o make decisions and offer support in the event of illness or a health issue, including determining your fitness for the role and making adjustments to support you at work;
o collect information which you provide to us as part of any health review or claim, including occupational health and ergonomics assessments where relevant to your role; - understanding of your personal situation and individual needs to enable us to provide a tailored service that meets any physical or cultural needs that you may have;
- improve our overall employee experience, by improving our HR policies, procedures and our operating model. This includes collecting data from any online surveys you choose to complete (e.g. communications, engagement, leavers) – please refer to our separate Privacy Statement on Staff Surveys for further information;
- to contact you for the purpose of communicating emergency information in a critical incident (e.g. cyber-attack, total network loss or pandemic);
- so we can send you information about your employment (e.g. benefit schemes, pension, electronic payslips, staff surveys, ID badges);
- occasionally, where technical information is being delivered or where there is a legitimate business need, we will record meetings and presentations that use MS Teams, Zoom or similar technologies (we will notify you in advance if a meeting will be recorded and will offer options for those attendees who would rather not participate in a recorded session);
- for HR systems training purposes;
- collect recordings of Automated Call Distribution (ACD) user telephone calls (both internal and external) for training and monitoring purposes;
- to maintain the security, health and safety of all our staff and service users by:
o collecting photographs for use on staff ID cards
o collecting data from door access systems; - collecting equalities data is part of Sanctuary’s Equality Strategy: Inclusion for All and is therefore a core element of governance and making sure that we listen and respond to your needs, promote your interests and enhance trust within our community. Before or during your employment Sanctuary may invite you to share data on your diversity characteristics. These can be provided on a voluntary basis, and you can update or remove them via MySanctuary at any time;
- to allow us to communicate with you in the most appropriate way. For example, we can provide documents in large print if needed.
The table below sets out what further data we may require to manage your appointment by various role types. We will:
Lone-workers, | Company | |
|---|---|---|
| track your location using GPS technology, to ensure efficient use of vehicles and the safety of lone workers | ✓ | |
| monitor the movement of company mobile phones and/or mobile devices to ensure lone worker safety | ✓ | |
collect information to verify driver eligibility
| ✓ |
We may also receive personal information indirectly, from the following sources in the certain circumstances:
- Recruitment agency
- Referee
- Disclosure & Barring Service (DBS)
What information are we collecting?
To facilitate the purposes detailed in section 4 we collect the following information:
- Name and contact details
- Date of birth
- National Insurance number
- Nationality
- Country of birth
- Bank details
- Relationship status
- Emergency contact details
- Next of kin details
- Training records
- Staff survey responses
- Photograph
- Door access information
- Communication preferences
- Information and communication systems usage
- Employment performance information
Where applicable we collect work eligibility data to ensure compliance with legal and regulatory requirements. This information allows us to verify employee’s suitability for specific roles, maintain a safe working environment, and meet industry standards. This includes the following information:
- ID documents for visa checks (British and Irish citizens only)
- Right to work status, documentation and share code
- Supporting documentation and information for DBS checks (including 3-year DBS re-check)
- Criminal conviction check results
- Role-specific qualifications and registrations
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:
- Health data, including disability
- Trade union membership
- Gender and gender identity data
- Racial or ethnic origin
- Religious or philosophical beliefs
- Sexual orientation
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(b) Performance of a contract – using your information in this way is necessary for us to perform the employment or services contract in place between us and to take steps at the request of you prior to entering into the contract.
(c) Compliance with a legal obligation – using your information is necessary for us to comply with legal obligations to which we are subject, in accordance with the UK employment laws as an employer and as a provider of care and support services.
(f) Legitimate interests – using and processing your information is necessary for communicating emergency information in a critical incident and for collecting data from any online surveys you choose to complete.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(a) Explicit consent to process your equality and diversity data. You can manage this information via MySanctuary and remove at any time. You are also able to remove your consent at any time by contacting HRDO@sanctuary.co.uk.
(b) Employment, social security and social protection
Our basis in Law is Section 1(a) of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- pension companies, for the purpose of managing retirement savings schemes related to your appointment;
- benefit companies, for the purpose of managing employee benefit schemes related to your appointment;
- occupational health and insurance companies/brokers, for the purpose of managing health related issues and policies relating to your appointment;
- it may be necessary to provide our occupational health provider with your contact details in order for a health questionnaire to be sent to you following your appointment;
- we may need to provide insurance companies with information about your health, to comply with employment related insurance policy terms;
- training companies, colleges and funding/awarding bodies, for the purpose of providing learning and development during the course of your employment;
- future employers, for the purpose of providing factual references;
- recruitment companies, for the purpose of managing your appointment;
- debt collection agencies, for the purpose of obtaining outstanding monies in relation to your appointment;
- fleet management companies, for the purpose of managing, maintaining and servicing company provided vehicles;
- solicitors, advocates and trade union representatives, for the purpose of dealing with legal issues in relation to your appointment;
- safeguarding organisations and emergency services for the purpose of protecting our staff and residents;
- the police for the purpose of detection and prevention of crime; and
- organisations with a function of auditing and/or administering public funds for the purpose of detection and prevention of fraud.
- Home Office, to check a prospective employee/employees immigration or right to work status.
- DBS (Disclosure & Barring Service), to carry out a DBS checks.
- the Driver and Vehicle Licensing Agency (DVLA) for checking employee eligibility to drive
- Vehicle and Operator Services Agency (VOSA) for the safe and legal operation of the Group’s vehicles.
Data processors and Transfers
To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- DBS check facilitation service – to process checks for criminal convictions to ensure suitability for roles.
- References processor – to process reference checks for new starters.
- Driving license check facilitation service – for the purpose of collecting the driving licence information from the DVLA.
- digital right to work check provider – to process digital right to work checks (British and Irish citizens only)
- vehicle suppliers for the delivery and collection of vehicles.
- companies producing benchmarking information to enable Sanctuary to obtain market data to make decisions in relation to your appointment
- mail fulfilment companies, for the purpose of printing and dispatching communications and ID or service badges related to your appointment
- engagement companies, for the purpose of undertaking staff surveys and seeking feedback on the organisation;
Whenever we transfer your personal data out of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that we rely on an adequacy decision, and/or use specific contract clauses which give personal data the same protection it has under UK law.
We use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Once you are no longer working for us, we will review the information which we hold concerning you and determine whether there are any reasons why we need to continue holding that information. For example, it may be necessary to retain information about you to manage income tax and national insurance queries or provide earnings details to pension schemes. Once the identified purpose comes to an end, unless there is another identifiable purpose for which it is necessary to hold on to your information, we will delete your information.
Recordings of ACD users’ calls will be kept for a period of 30 days for the purpose of staff training and development and will be deleted after this time.
From the employment end date, your employee file will be kept for 6 years.
From the employment end date, information contained in your employee file that relates to employer’s liability (i.e. training records, absence records, medical records relating to work related illness/accident) will be kept for 40 years.
From the employment end date, information related to driver’s licenses, expense claims and benefits will be retained for 6 years following the purpose it was used for.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association, a part of Sanctuary Group (‘Sanctuary’), one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
Sanctuary uses your personal information to monitor and manage the health and safety of members of the public, customers and staff who have had an accident or incident whilst working or accessing Sanctuary services, land or buildings, as required by the Health and Safety at Work Act 1974 and subsidiary regulations. The processing of your information is necessary for compliance with the legal obligations contained in this Act.
We will use your personal information in one or more of the following circumstances:
- where you report an accident, injury or incident or where an accident injury or incident occurs involving you.
- where it is necessary to ensure your safety
- where you have witnessed an accident or incident.
- to maintain accurate and up-to-date accident, injury and incident records.
- investigate accidents and incidents to minimise the chance of reoccurrence.
- fulfil our legal obligations under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
- fulfil our legal obligations under the Management of Health and Safety at Work Regulations
- enable us to establish, exercise or defend possible legal claims both criminal and civil.
What information are we collecting?
We currently collect and process the following information:
- your contact details, including the following:
o your name
o address
o telephone number
o personal e-mail address - age and/or date of birth
- data entered on accident and incident report forms
- video recordings of incidents (if applicable)
- photographs of an injury sustained (if applicable)
Some of the information which we collect may be special categories of personal data (also called sensitive personal data), including specific information relating to any injuries, ill health or their progression because of an accident or incident.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(c) Compliance with a legal obligation - Using your information is necessary for us to comply with a legal obligation to which we are subject in accordance with the Health and Safety at work Act 1974 and Diseases and Dangerous Occurrences Regulations 2013.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(b) Employment, social security and social protection.
Our basis in Law is Section 1 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to meet our health and safety obligations.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- NHS and clinical teams if the accident or incident resulted in an injury
and emergency assistance is required - our insurers, in connection with any public liability claim
There may be occasions where we share information with the Health and Safety Executive; this is a legal requirement under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013.
In accordance with the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations Act 2013 we are required to report on the following:
- fatal accidents.
- accidents to non-workers (members of the public and customers) arising out of a work activity requiring the individual to attend hospital for treatment.
Data processors and Transfers
To facilitate our health and safety obligations, information may be shared with our IT platform provider for the purposes of technical system support and troubleshooting.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will generally hold your personal information for six years from the date of any accident or incident. The exceptions are:
- if the accident or incident results in a civil claim or criminal proceedings, the information will be held for at least the duration of any claim or proceeding.
- if the accident or incident involves a child, the information will be held for three years after their 18th birthday.
- if the accident or incident results in an occupational disease, the information will be held for at least 40 years in accordance with current legislation.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association, a part of Sanctuary Group (‘Sanctuary’), one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
When visiting our premises we collect and process your information for site security, safety and fire evacuation purposes, as well as to ensure you are identifiable.
What information are we collecting?
Most of the personal information we process is provided to us directly by you when completing our signing-in and signing-out sheet.
We collect and process the following information:
- Name
- Contact details (if applicable)
- Vehicle registration number (if applicable)
- Site location
In relation to visitors to our Worcester head office site, we also take a photograph of you which is printed as part of your visitor pass which is required to be worn while on site for security purposes to ensure you are identifiable.
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(c) Compliance with a legal obligation - using your information is necessary for us to comply with a legal obligation to which we are subject in accordance with the Health and Safety Act 1974.
(f) Our legitimate interests or that of a third party – for the purposes of security.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best facilitate this process.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
To facilitate this process, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- System providers for technical IT support (to enable the creation of ID badges and provide fob access – if applicable).
- security companies that are responsible for on-site security (where applicable)
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Information captured via our Visitor Management System at our Worcester Head Office, is retained for one week from the date of visiting the premises.
We will keep the information that is provided to us in our signing in and out sheets for 6 years from the date of visiting the premises.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information.
Ask us to rectify the information where it is inaccurate or is incomplete.
Ask us to limit and restrict what we do with your information.
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association and its wholly owned subsidiaries, together Sanctuary Group ("Sanctuary") one of the UK's leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
The information provided to us by your agency during your assignment(including that obtained during the recruitment process) is necessary for us to facilitate your assignment as a worker. This information is required for us to manage and perform the services you provide. Without this information, we will not be able to facilitate your assignment with us.
We collect personal data about agency workers during recruitment and assignment to manage our business operations effectively, comply with legal and regulatory obligations, and maintain a safe work environment. Specifically, we need this information to:
- Verify identity and right to work
- Facilitate recruitment and payroll processes
- Meet legal and regulatory compliance requirements
- Ensure workplace health and safety, and security
We may also collect information that is relevant to your application via a third party you have provided information to, such as:
- Recruitment agencies
What information are we collecting?
The information that we are collecting about you is information which is provided to us during the course of your assignment, including that obtained as part of the recruitment process and information provided by you whilst you are engaged by us as an agency worker. The list below sets what data we require:
- Name
- Contact details
- Gender
- Job title
- Date of birth
- Right to work information including status, share code, visa type, expiry data and a copy of the right to work document
- Training history
- Qualification certificates
- References
- Photograph for identification purposes
- Criminal conviction details including date of last DBS/PVG check and DBS/PVG number
- Health conditions screening question in relation to fitness for work
- Hepatis B status (if applicable)
o If your job requires that you carry out tasks that involve using needles/sharps, and you have not already been vaccinated against Hepatitis B (including boosters as required) and/or do not have an immunity to Hepatitis B, you should speak to your agency and/or manager as soon as possible about obtaining this vaccination from your GP. - Scottish Social Services Council Registration Number and details (if applicable)
- Nursing & Midwifery Council Pin Number and details (if applicable)
- Car insurance (if applicable)
- Driving license (if applicable)
- Student term time dates (if applicable)
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(c) Compliance with a legal obligation – using your information is necessary for us to comply with a legal obligation to which we are subject, in accordance with UK employment laws as an employer and as a provider of care and support services.
(f) Legitimate interests – using your information is processing is necessary for the purposes of our legitimate interests during your assignment (including that obtained during the recruitment process) is necessary for us to facilitate your assignment as a worker. This processing is essential for managing and performing the services you provide. Without this information, we would be unable to facilitate your assignment with us.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(b) Employment, social security and social protection
In Our basis in Law is Section 1(a) of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Data processors and Transfers
To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- HR platform system support
We also use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
These transfers are made in accordance Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Any personal data held in connection with your agency work will be retained for up to 6 years after end of assignment.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Purpose of our privacy statement
Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.
Who are we?
We are Sanctuary Housing Association and its wholly owned subsidiaries, together Sanctuary Group ("Sanctuary") one of the UK's leading
providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.
Our data protection officer
Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
Why are we collecting your information?
The information that you provide to us via our online recruitment portal, on your application form, curriculum vitae and covering letter and any other communications between us in connection with your application, is required by Sanctuary in order for us to process your application appropriately and in line with current legislation. Without this information, we will not be able to consider your application.
We would also like to contact you in relation to other career opportunities we think you may be interested in after creating your Sanctuary profile. This is voluntary, but if you consent, when creating a profile or submitting an application we will use contact details provided by you for this purpose. If you do not want to be informed of any career opportunities, please leave the ‘Opt-In if you would like to receive Marketing e-mails about future job opportunities’
box unticked.
We would also like to inform you about new job posting notifications through the job alert function. This is voluntary, but if you consent, you can create job alerts based on key words and locations of your choosing when creating your profile or at any point afterwards. If you do not want to be informed of any job alerts please leave the ‘Opt-In if you would like a Job Alert automatically created’ box unticked.
You can manage and update your marketing preferences at any time via your profile.
We may also collect information that is relevant to your application via a third party you have provided information to, such as:
- Recruitment agencies
- Apprenticeship organisations
- Online recruitment services, such as Indeed.com
- Social media sites, such as LinkedIn
What information are we collecting?
The table below sets what data we require during the recruitment process depending on the terms of your employment and whether you are already employed at Sanctuary or not.
Some of the information which we collect will be special categories of personal data (also called sensitive personal data), such as information about any disability you may have. You need to be aware that we will use this information to ensure we deliver services to you in an appropriate manner. An understanding of your personal situation and individual needs will allow us to provide a tailored service that meets any physical or cultural needs that you may have.
Application Stage
Category of data | Existing employee | Prospective |
|---|---|---|
| Name and contact details | ✓ | ✓ |
| Employee ID | ✓ | |
| Right to work – screening question about whether you have the right to work in the UK | ✓ | ✓ |
| Criminal conviction results – screening question about whether you have any cations or convictions | ✓ | ✓ |
| Health conditions including disability – screening question in relation to fitness for work | ✓ | |
| Adjustments needed: Sanctuary Group is committed to ensuring that our recruitment processes are barrier-free and as inclusive as possible to everyone. This includes making adjustments for people who have a disability or long-term condition. If you would like us to do anything differently during the application process, please provide details | ✓ | ✓ |
| Employment history | ✓ | ✓ |
| Education and training history | ✓ | ✓ |
| CV/Resume | ✓ | ✓ |
| Hepatis B status (if applicable) If your job requires that you carry out tasks that involve using needles/sharps, and you have not already been vaccinated against Hepatitis B (including boosters as required) and/or do not have an immunity to Hepatitis B, you should speak to your manager as soon as possible about obtaining this vaccination from your GP. | ✓ | ✓ |
| Driving Licence – screening question about whether you hold a valid license | ✓ | ✓ |
Offer Stage
Category of data | Existing employee | Prospective |
|---|---|---|
| Name and contact details | ✓ | |
| Employee ID | ✓ | |
| Job title | ✓ | |
| Date of birth | ✓ | |
| Gender and gender identity | ✓ | |
| Identification documentation | ✓ | |
| National Insurance number | ✓ | |
| Nationality | ✓ | |
| Country of birth | ✓ | |
| Right to work documentation | ✓ | |
| Right to work share code | ✓ | |
| Immigration/right to work status | ✓ | |
| Bank details | ✓ | |
| Relationship status | ✓ | |
| Criminal conviction results | ✓ | ✓ |
| Health conditions including disability – screening question in relation to fitness for work | ✓ | |
| NMC (Nursing & Midwifery Council) Pin Number and details | ✓ | ✓ |
| Facial biometric data (British and Irish citizens only) | ✓ | |
| Racial or ethnic origin | ✓ | |
| Religious or philosophical beliefs | ✓ | |
| Sexual orientation | ✓ | |
| Title | ✓ | |
| Disability Group | ✓ | |
| Evacuation Plan | ✓ | |
| Emergency Contact | ✓ | |
| Referee details | ✓ | |
| Full employment history | ✓ | ✓ |
| Immunisation History | ✓ | |
| CQC/Care Inspectorate | ✓ | |
| Gender Pronoun | ✓ |
Offer Stage (if criminal records check required)
Category of data | Existing employee | Prospective |
|---|---|---|
| Mother’s maiden name | ✓ | ✓ |
| Town of birth | ✓ | ✓ |
| Driving licence details | ✓ | ✓ |
| 5-year address history | ✓ | ✓ |
| Previous names | ✓ | ✓ |
| DBS Supporting Documentation | ✓ | ✓ |
What is our lawful basis for using your information?
Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:
(a) You have given your consent – for us to contact you about other opportunities and provide job alerts to you via your communication preferences in your profile. You can amend your settings in your profile to remove you consent at any time.
- When logged into your candidate profile, there is a field ‘Opt-In if you would like to receive marketing e-mails about future job opportunities’ where the tick box can be amended (ticked/unticked).
- For job alerts, you can go into the job alerts section and delete/dustbin any job alerts that have been set up.
- You can also e-mail dataprotection@sanctuary.co.uk to revoke your consent.
(b) Performance of a contract – using your information in this way is necessary for us to consider entering into a contract of employment with you, subject to the recruitment process.
(c) Compliance with a legal obligation – using your information is necessary for us to comply with a legal obligation to which we are subject, in accordance with UK employment laws as an employer and as a provider of care and support services.
In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(b) Employment, social security and social protection.
Our basis in Law is Section 1(a) of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection. Collecting this information is necessary to use that information for carrying out our obligations and rights relating to your prospective employment with us.
Sharing your information
Members of Sanctuary Group
Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate the recruitment process.
For more information on which companies make up Sanctuary Group, please go to About Sanctuary.
Regulators and other legal obligations
We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
We may from time to time share your information with other organisations, such as:
- Disclosure and Barring Service and/or Disclosure Scotland
- Digital right to work check provider – to process digital right to work checks (British and Irish citizens only)
Data processors and Transfers
To facilitate the delivery of services to you, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:
- DBS check facilitation service – to process checks for criminal convictions to ensure suitability for roles.
- References processor – to process reference checks for new starters.
We also use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.
We use a third-party processer, for integration from applications sent via Indeed who transfer your data to us via the United States of America.
These transfers are made in accordance Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.
For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Storing your information and deleting it
We will not keep your personal data for longer than we need it or are required to by law.
Any personal data held in connection with your application will be stored while the application is active, and for a maximum of 12 months after an application has been closed, after which point it will be anonymised. Thereafter application information may be retained on Sanctuary’s systems anonymously in accordance UK legal and regulatory requirements.
Any personal data held on your candidate profile will be stored while your profile is active, and automatically deleted after 12 months of inactivity.
If you are interviewed but are not successful with your application, your interview data will be deleted after 6 months from the date of your interview.
You can delete your candidate profile at any time by logging into your account, going to ‘Options > Settings’ and clicking the ‘Delete Profile’ button.
Your rights
In relation to the information which we hold about you, you are entitled to:
Ask us for access to the information;
Ask us to rectify the information where it is inaccurate or is incomplete;
Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
Ask us to limit and restrict what we do with your information;
Object to our use of your information and ask us to stop that use;
Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe
House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Can we use your information for any other purpose?
In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Security and your rights
Security of your information
The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
Only relevant members of staff will access the information you provide to us.
Your rights
In relation to the information which we hold about you, you are entitled to:
- Ask us for access to the information;
- Ask us to rectify the information where it is inaccurate or is incomplete;
- Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
- Ask us to limit and restrict what we do with your information;
- Object to our use of your information and ask us to stop that use;
- Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order to transmit the data to another data controller;
- Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
- Make a complaint to us if you are concerned about how we have handled your personal data.
Our obligations to comply with the above rights are subject to certain exemptions.
To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.
How to complain
If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
You also have the right to complain to the Information Commissioner's Office (the 'ICO') if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.