ExtraCare Customer Privacy Notice

ExtraCare are committed to safeguarding the privacy of all individuals who interact with us and we respect the privacy choices you make. 

This privacy notice explains how we collect, use, share and protect the information we collect through our interaction with you, and your rights in relation to that. 

Who We Are and How To Contact Us

When we refer to 'ExtraCare', we are referring to The ExtraCare Charitable Trust. ExtraCare was established in 1988. We develop and run retirement villages and smaller housing developments. ExtraCare is the Data Controller. We are a registered charity number 327816, and a company limited by guarantee and registered in England and Wales as company number 2205136. Our registered head office is:

7 Harry Weston Road
Binley Business Park
Coventry
CV3 2SN

ExtraCare Retail Limited is a wholly owned trading subsidiary which operates our charity shops across the Midlands and the North of England.

If you have any questions regarding this Privacy Notice or how to exercise your individual rights afforded under data protection legislation, please contact our Data Protection Officer:

The ExtraCare Charitable Trust
Tel: 02476 509023
Email: privacy@extracare.org.uk
Web: www.extracare.org.uk

ExtraCare has an established framework of policies, procedures, contracts and training in place dealing with data protection, confidentiality and security across our organisation and regularly review the appropriateness of the measures we have in place to keep the personal information we hold secure.

Please click on the relevant headings below, which will take you to more information on each of the areas described.

We recognise that we have an ongoing responsibility of transparency with data subjects so we keep this privacy notice under regular review and therefore encourage you to check it regularly. We will include a notification on our website's home page if we make any significant changes to this privacy notice. 

Your Data and How We Process It

ExtraCare only collects and processes data which is necessary for the purpose intended. We do not keep data for longer than it is needed. We look after your data and use up to date security measures to keep it safe. We use your data in order to:

 Your Personal Information, What and Why We Use It

Processing Purpose

Legal basis for Processing

Applications for rented properties

When you apply to live in an Extracare Village, we collect information directly from you and from relevant third parties, about you and your household, in order to assess your eligibility and suitability for the application you have made.

We receive your contact details and housing need information from the Local Authority if you have been nominated by them and we take up references from former landlords.

Some decisions are made automatically about your eligibility, based on the answers you provide in your application, but you will always be given the opportunity to challenge the decision.

This processing is necessary for being considered for, and for signing up to, a tenancy agreement, which means entering into a contract with us. We need to know that you are eligible, and that you can afford the property, and/or sustain your tenancy and we may need to offer you additional support as part of your tenancy.

If you provide us with special categories of data, such as health, in your housing application, we will process this data only as far as it is necessary for us to manage your application and ensure you are housed appropriately and safely, in line with our legal and statutory obligations as a housing provider and employer.

In some cases, we will process information about criminal offences and convictions, where it is necessary to do so in order to protect the safety and wellbeing of individuals and our communities.

When we ask for information about race/ethnic origin, religion, health, or sexual orientation, this is where it is necessary for us to monitor and improve equality of opportunity and treatment, in the substantial public interest, and it is optional for you to provide this information.

 Shared Ownership applications

When you apply to purchase a share of an ExtraCare home, we collect information directly from you and from relevant third parties, about you and your household, in order to assess your eligibility and suitability for the application you have made.

We will communicate with your solicitor and mortgage provider to facilitate the purchase.

This processing is necessary for entering into a purchase agreement with us. We need to know that you are eligible and can afford the property.

In some cases, we will process information about criminal offences and convictions, where it is necessary to do so in order to protect the safety and wellbeing of individuals and our communities.

When we ask for information about race/ethnic origin, religion, health, or sexual orientation, this is where it is necessary for us to monitor and improve equality of opportunity and treatment, in the substantial public interest, and it is optional for you to provide this information.

Outright Sales

When you apply to purchase a share of an ExtraCare home, we collect information directly from you and from relevant third parties, about you and your household, in order to assess your eligibility and suitability for the application you have made.

We will communicate with your solicitor and mortgage provider to facilitate the purchase.

This processing is necessary for entering into a purchase agreement with us. We need to know that you are eligible and can afford the property.

In some cases, we will process information about criminal offences and convictions, where it is necessary to do so in order to protect the safety and wellbeing of individuals and our communities.

When we ask for information about race/ethnic origin, religion, health, or sexual orientation, this is where it is necessary for us to monitor and improve equality of opportunity and treatment, in the substantial public interest, and it is optional for you to provide this information.

CORE reporting

So that the Ministry of Housing, Communities and Local Government (MHCLG) can produce statistical information, we report information to them about our lettings and shared ownership sales via the CORE (Continuous Recording) system. The information provided does not include your name or full address, but it does contain special categories of data.

The processing of this information by the MHCLG is necessary for the performance of a task in the public interest and so far as the data includes special categories, the MHCLG states that the processing is necessary for reasons of substantial public interest. The data is used to compile statistics on the use of social housing, including reviewing equality of opportunity and treatment.

Please see the CORE website for more details.

ExtraCare customers

When you are an ExtraCare customer, we will collect information from our interactions with you, including any complaints or allegations that are made by you, or about you, and we process this information to allow us to manage our relationship with you, collect your rent, and provide you with tenancy or sales related services appropriate support services and to manage any complaints or alleged ASB or similar issues.

This will involve sharing information with, and receiving information from, third parties, as explained below.

Where crimes have been committed or alleged, we share information with the police and other agencies with investigative and prosecution powers.

Where we have concerns about anyone requiring safeguarding for any reason or requiring protection from financial abuse due to a mental or physical health issue, we share information with the relevant authorities in order to help the people concerned.

We share rent information with local authorities for the purposes of administration of appropriate benefits;

Where local authorities require information for council tax, we confirm tenancy information to allow the correct tax to be paid.

We share information with debt collection agencies so they can collect debts on ExtraCare’s behalf.

We sometimes share information with utilities companies so they can collect debts on bills.

Personal data is shared between teams internally at ExtraCare, but is only shared, accessed and used on a need-to-know basis, to enable relevant teams to carry out their tasks.

Most of the information we collect and use as part of our ongoing interactions with you is necessary for the performance of your contract and is linked to ensuring both you and ExtraCare are complying with the requirements of the contract.

We have a legal obligation to keep business and financial transaction records as appropriate.

We will offer you further support based on both our and your legitimate interests to enable you to sustain your relationship (tenancy/shared ownership relationship) with us to the best of your ability.

If we contact you by email or text to let you know about our services, we will do so based on either our legitimate interests of keeping you updated about the services you receive from ExtraCare, or based on your consent where we are contacting you about new services.

If we refer you to an external agency for further support, we will do so only with your consent to pass your details on to them, unless we believe there is an overriding lawful basis for the referral without your consent.

When we share information for the reasons explained, we will do so on the basis of the fact it is necessary to protect individuals and communities, is for a task in the public interest (crime, benefits and tax payment) or for the legitimate interests of debt collection.

Volunteers

If you are a volunteer we will usually collect your name and contact details and where/how you volunteer for the Charity. Where it is appropriate, we may ask for additional information.  We mainly use your data to:

The lawful basis for processing your data if you are a volunteer is our legitimate interest in order to Administer your volunteering activity. This is used to keep a record of your relationship with us; ensure we know how you prefer to be contacted and to understand how we can improve our services and information.

 

Our support services

ExtraCare does not just provide housing, we also provide support to people who need it, through our specialist services, some of which are linked to your tenancy and some of which are standalone, for example help with money management, getting back into work, or more general day to day support.

We process your data as part of providing this support on the basis of our contract with you, where it is tenancy-linked support, or on the basis of it being necessary for complying with our legal obligations or carrying out a task in the public interest.

Where we process special categories of data, or criminal information, about you as part of providing this support, we do this where it is necessary to protect individuals in line with our legal and statutory obligations as an employer and as a housing and support provider. Where this (or another) basis is not appropriate, we will ask for your consent.

Emergency situations

Unfortunately, there will always be emergency situations that negatively impact on our customers, employees and wider communities, and we will respond as appropriate and as quickly as possible in order to protect people and property. Whether we are responding to fire, flood, crime, safeguarding issues, pandemic, or any other emergency situation, ExtraCare will treat people’s health and wellbeing as a priority, which we acknowledge includes protecting personal data and ensuring it is handled lawfully and securely.

Processing of data in the immediate response to emergency situations is done only where it is necessary to protect individuals and communities, on the basis that we are acting under employment or social protection law, or in the public interest / substantial public interest.

Equality of treatment & opportunity

ExtraCare is dedicated to treating everyone fairly and providing equal opportunities, regardless of differences in race or ethnic origins, religious or philosophical beliefs, physical or mental health or sexual orientation. In order to monitor and improve performance in this area, we collect information about race, beliefs, health and sexual orientation from customers and employees, if you are happy to provide this information.

The processing of these special categories of data is necessary for a task which is in the substantial public interest, specifically for the purposes of identifying and monitoring equality of opportunity and treatment between different groups of people, with a view to enabling equality to be promoted or maintained.

Sharing your data with our ‘Processors’

When ExtraCare uses other companies to supply goods or services on our behalf, sometimes we need to share relevant information with those suppliers and contractors so they can carry out that work. They are known as our ‘Processors’ and are legally bound by contract to act only on our instructions regarding your personal data, and not use it for their own purposes.

The relevant legal basis for each Processor we use will be dependent on the type of work they are carrying out for us, and our legal basis for undertaking the processing that is linked to that work.

For example, we carry out emergency repairs work on the basis of our contract with you, and in some circumstances the repairs may be contracted out to contractors who need your address etc. in order to carry out the repair. This makes the contractor our Processor.

The contracts we use with Processors comply with Article 28 of the General Data Protection Regulation (GDPR), which rules how Processors are appointed, and sets out their relevant responsibilities.

Sharing your data with other contractors

Sometimes, we share personal data with suppliers, contractors or consultants where they process the data on the basis of their own knowledge and expertise, not just acting on our instructions. For example, solicitors. In these cases they are not our Processors, but instead are Data ‘Controllers’ in their own right.

As Data Controllers these organisations have their own legal obligations and responsibilities to handle your data lawfully and safely and are also bound by contract to comply with their data protection obligations.

We share information with contractors etc. who are Controllers only when it is necessary for us to carry out our tasks in the public interest, to carry out our legal obligations, or for our legitimate interests of outsourcing the provision of some services and of providing appropriate support, to enable us to run the business efficiently. We do not share your data with any Controllers that we are not confident will protect your data, and therefore we protect your rights, freedoms and interests.

Insurance

If you are an ExtraCare insurance customer, we will process your information so we can provide you with a policy and to manage any claims you make, which may involve sharing information with third parties about the circumstances in order to assess the claims.

This processing is necessary for the performance of your insurance contract. If it is suspected that a claim is not legitimate, we will process information to protect our business from fraudulent claims, which breach the insurance contract.

Complaints

In order to investigate and respond to complaints or allegations against ExtraCare or an employee or customer of ExtraCare, or complaints and allegations made about neighbours, or any other topic, we will usually require contact details and information about the complaint from you or your representative. We will request the minimum amount of information from you, and only use it for the purposes of the investigation.

Customer complaint related processing is done on the basis of it being necessary for us complying with the terms of your contract with us. For complaints from non-customers, depending on the nature of the complaint, the processing is necessary for us to comply with our legal obligations or for carrying out our tasks in the public interest. If special categories of data are processed (including health, race, religion, sexual orientation) it is on the basis of being necessary for defending a legal claim or for acting in the substantial public interest. This includes responding to elected representatives such as MPs, who have raised a matter on your behalf.

General contacts

For members of the public who are not customers but come into contact with ExtraCare in another way, such as to make an enquiry, we will collect information from our interactions with you, so that we can provide you with the information you have requested.

We process this information on the basis that it is necessary for our legitimate interests of responding to your enquiry, complaint or allegation, as appropriate. If we need to process any special categories of data in order to handle the issue, we do so with your explicit consent, or on the basis of it being necessary for a task in the substantial public interest, such as reviewing equality of opportunity and treatment.

Business contacts

Contact details for people, organisations and companies we work with is personal data and we treat it accordingly. We will use it only as part of our relationship with your organisation, whether we work in partnership or have a customer/supplier relationship.

This processing is based on our legitimate interests of managing business relationships appropriately. We use the data only for the purposes explained, keep the data secure and safe, and protect your rights, freedoms and interests.

Surveys and feedback

In order to understand our customers’ experiences and improve our services and products, we will contact you at various “touch-points” during our relationship with you and ask you to complete a survey and give us feedback, by email, text or over the telephone. We contract with specialist companies to carry out surveys on behalf of ExtraCare, which involves sending them your contact details and they gather your responses for us. You can opt out of this sort of contact if you prefer.

ExtraCare, and the specialist companies we work with, process data in order to ask for your feedback, based on our legitimate interests of improving our customer services and products.

Marketing

We will send you information that we think will be useful or of interest to you about the services we provide, whether they are paid for services or free of charge. We will sometimes make decisions about what information to send based on your profile, for example your age if we are letting people know about age-related services such as our over 55s schemes.

ExtraCare will send you marketing materials on the basis of our legitimate interests of increasing our customers’ knowledge of other relevant services and products.

We will only send you emails or texts (electronic direct marketing) with this type of information if we have your consent to do so. If you have provided consent, you can with draw this at any time. For commercial services or products, which includes where you have bought, or entered into negotiations with us, for a similar service or product, this is regarded by the law as implied consent. However, every time we send an email or text you will have the option to unsubscribe from similar marketing messages.

 

We will have regard to the ICO’s Code of Practice on Direct Marketing in determining our approach. We will respect people’s choices not to receive direct marketing from us. We will not use ‘bought in’ lists of potential targets unless the respective individuals on the lists have consented to their data being shared with ExtraCare for the relevant purpose beforehand and will ensure we have either specific consent, or that we can rely on the ‘soft opt in’ for any electronic marketing communications we send to customers or potential customers.

Exercising of Data Protection Rights

If you approach us about exercising any of your Data Protection rights, such as accessing copies of your data, or objecting to the way your data is being processed, we need to obtain relevant information from you in order to identify that you are the data subject in question or acting on their authority.

When we fulfil requests such as these, specialist staff members will review the documents in question in order to fulfil the request lawfully, which will include redacting information about third parties.

The information processed to check your identity and to fulfil your request is only used for these purposes and is kept securely.

This processing is carried out as necessary for us to carry out our legal obligations of upholding your Data Protection rights.

Recruitment

If you apply for a job with ExtraCare, we collect information about your suitability via our trusted recruitment partner organisations.

Most of this processing is on the basis that it is necessary for an employment contract, or entering into an employment contract, with ExtraCare.

Employees

We collect and process information about current and former employees as part of managing your relationship with ExtraCare.

Most of this processing is on the basis that it is necessary for managing your employment contract with ExtraCare, and for us to fulfil our legal obligations under employment law in relation to current and former employees.

Please see the Employee Privacy Notice on the Extracare website and Sharepoint for more details.

Supporters

If you support us, for example you make a donation or buy something from our shops, we will usually collect: your name; your contact details; your bank or credit card details (In order to process your donation, for example); whether you have agreed to receive marketing material from us. Where it is appropriate, we may ask for additional information. 

We mainly use your data to: provide you with the service or information you have asked for; administer your purchase or donation, including processing gift aid; keep a record of your relationship with us; ensure we know how you prefer to be contacted; understand how we can improve our services and information.

 

The lawful basis for processing your data is our legitimate interest.

CCTV

ExtraCare uses CCTV in our offices and in some of our housing/schemes for the safety and security of premises, colleagues, customers and any third parties. CCTV footage can be disclosed to those organisations acting on official authority, including the police.

We process data from CCTV for the purposes of our legitimate interest of protecting our premises, and for carrying out tasks in the public interest/substantial public interest by protecting our people and supporting investigations into crime and fraud, for example.

Telephone calls

Phone calls to our main telephone number are recorded so that we can monitor the quality and content of calls.

This processing is on the basis of our legitimate interest of providing good customer service, as well as protecting our colleagues and other people from any problems or issues arising from ambiguity in phone call conversations.

Website

We collect information you submit through our website, and through the use of Cookies. Please see the Cookies section below for more details.

This information is processed for our legitimate interests of responding to any enquiries you make through our website, and to help us understand and analyse the effectiveness of our website.

In order that we are able to provide you with the services you require, for example to assist you with a housing enquiry, or seeking access to care or wellbeing services, we may need additional ‘sensitive’ information from you. This may come directly from you, or from a third party on your behalf, for example from a family member or GP.  Examples of this sensitive information includes any medical conditions you may have or your racial or ethnic origin.

We will normally only hold, use and share this ‘sensitive’ information with your explicit permission, although there may be reasons when we are required to do so by law, or to protect your vital interests. In such circumstances we may process your information without your knowledge or consent, but this would be extremely rare, but possible.

What Personal Information We Collect and Receive From Third Parties

We receive personal information (name, address, next of kin, gender, marital status, benefit status, health and care support needs and current care provision if applicable) from our Local Authority Social Services and Housing partners to enable us to allocate rental properties and assess care needs. We may receive personal data from other Housing Associations in case of housing transfers.

Who We Share Your Personal Information With
We may, with your permission, share your data with external healthcare providers such as GPs and Social Services to assist in providing care and healthcare support. Should we receive your personal data through a direct application to us for housing, we will share this with the relevant Local Authority housing team to enable us to assess your eligibility for housing and benefits.

Data relating to Personal Evacuation Plans (name, apartment number, specific assistance needs) may be shared with the Fire Service in an emergency.

We may share CCTV images with Police and other law enforcement agencies if we receive a valid request from them. We may also share limited CCTV and door entry data with suppliers in the event of a fault with the system. The CCTV system at some locations is accessible by residents on their own TVs to enable them to view persons waiting for entry to the location at the main doors or the access control points to the residential wings in order that they are able to prevent unauthorised access and detect and/or prevent crime. At some locations the CCTV system will enable staff to view persons waiting for entry into the location through their VoWLAN Handset.

Personal details and probate as part of lease signing / filing with our solicitors as part of the sale and buy back of properties.

Within our retail division, to enable registration and operation of the scheme, we will share with GiftAid your name, address and email.

Data Retention

We will store your personal information for as long as is reasonably necessary for the purposes for which it was collected, as explained in this notice. In some circumstances we may store your personal information for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax, accounting, or necessary technical requirements.

In specific circumstances we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

Data Sharing

For the above purposes, personal information may be transferred within or outside of the jurisdiction where you are employed or perform work, either within ExtraCare or to third parties, including, but not limited to:

ExtraCare may also disclose personal information to a third party where it is necessary to do so in order to protect or pursue ExtraCare legitimate interests (ensuring this is proportionate and limited to that information which is strictly necessary in the circumstances). This may include, but not be limited to, disclosure to a party with whom ExtraCare is in negotiation for the sale or transfer of a business, assets or services. ExtraCare will take appropriate steps to ensure that the recipient of personal information in such circumstances puts in place an adequate level of protection for such personal information in accordance with applicable legal requirements.

Where ExtraCare transfers personal information internally within ExtraCare or to any third party between different jurisdictions, including, but not limited to, transfers outside of the European Economic Area (EEA) including the USA, and to other jurisdictions that have not been deemed to offer adequate protection, for the purposes outlined in this document, it will take appropriate steps to ensure that there is an adequate level of protection for personal information in place in accordance with applicable legal requirements.

Changes to your personal information

If your personal information changes at any time, please keep us informed so we can ensure your information is accurate, complete and current. If you wish to update your personal information, you can inform us of this via the following means:

Your Rights As A Data Subject

You have a number of legal rights in relation to the personal data that we hold about you and you can exercise your rights by contacting us using the details at the end of this document. These rights include:

Please note we sometimes require further information from you in order to verify your identity before disclosing, amending or deleting any of your personal information.

In most cases, we will deal with your requests free of charge and within one month of receipt of your request. However, there are exceptions that can allow us to charge a reasonable fee to cover our administration costs and/or extend the time period for dealing with your request by up to a further two months from receipt of your request, such as where your request is complex or repetitive. If an exception applies, we will keep you informed.

We will never charge you to change your marketing preferences or unsubscribe to our marketing communications.

In the UK, your rights arise from the General Data Protection Regulation as retained, amended EU law, and the supervisory authority is the UK Information Commissioner (https://ico.org.uk/).

Write to us at: The ExtraCare Charitable Trust, 7 Harry Weston Road, Binley Business Park, Binley, Coventry, CV3 2SN.

Telephone us on: 02476 506011

Email us at: privacy@extracare.org.uk

You also have a right to lodge a complaint with the Office of the Information Commissioner at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113 (local rate) or 01625 545 745.

Full details of our Employee Privacy Policy can be found here.