Residents and Prospective Residents Privacy Notice
ExtraCare was established in 1988. We develop and run retirement villages and smaller housing developments. ExtraCare is the Data Controller. We are a registered charity number 327816, and a company limited by guarantee and registered in England and Wales as company number 2205136. Our registered head office is:
7 Harry Weston Road
Binley Business Park
Coventry
CV3 2SN
In this Privacy Notice (Notice), “We,” “Us” and “Our” means ExtraCare Charitable Trust (ExtraCare), “You” means the client who ExtraCare is processing the application for housing, that you or your nominated third party, such as your local authority, have requested.
We are committed to maintaining the accuracy, confidentiality, and security of your personal information. Data protection law provides you with a right to be informed about the processing of your personal information. This Notice describes the personal information that we collect from or about you, and how we use and to whom we disclose that information. Where it is appropriate to the delivery of the service and in accordance with our contract with you or as required by law, we may also prescribe additional purposes and longer retention periods to those set out below.
What Personal Information Do We Collect?
For the purposes of this Notice, personal information is any information about an identifiable individual. Personal information does not include anonymous or non-personal information.
We collect and maintain different types of personal information in respect of those individuals who seek to be, are, or were our clients, including the personal information contained in:
- What you tell us about yourself, either face to face, via telephone or in writing;
- ID Information such as your name, home address, email address, telephone numbers and date of birth;
- Next of kin contact information;
- Financial information;
- Medical records and health information including medicine dosage;
- Personal preferences;
- Ethnicity and religious affiliation;
- NHS number;
- Telephone call recording;
- Door access codes;
- Risk assessments;
- Dietary requirements;
- Our records of invoicing and payment; or
- Criminal offences and convictions.
The personal information which we collect and maintain includes the above and any other information necessary to process your application. In addition, we may collect and maintain sensitive personal information about you if that has any relevance to your application.
As a general rule, we collect personal information directly from you or from the local authority or others also involved in your housing need. We may take up references from former landlords. In most circumstances where the personal information that we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you or implied from your actions or agreed under contract).
Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.
Why Do We Collect Personal Information?
The personal information collected is used and disclosed for our business purposes, including establishing and managing your relationship with us. Such uses include:
- Assessing whether we are able to assist you;
- The management of your care;
- Maintaining records of services provided to you;
- Invoicing, fee collection and debt recovery;
- Keeping records up to date;
- Complying with the legal and regulatory obligations;
- Implementing best practice and guidance from the Care Quality Commission or other regulatory or governmental bodies;
- Performance of a task in the public interest; or
- Such other purposes as are reasonably required by us.
How Do We Use Your Personal Information?
We may use your personal information for the purposes described in this Notice, or for any additional purposes that we advise you of. Where your consent is required this will be requested and recorded in a clear unambiguous way. Where your consent is required for our collection, use or disclosure of your personal information, you may, at any time, subject to legal or contractual restrictions and to reasonable notice, withdraw your consent. All communications with respect to such withdrawal or variation of consent should be in writing and addressed to ExtraCare.
We may use your personal information without your knowledge or consent where we are permitted or required by law or regulatory requirements to do so.
Who is responsible?
The person responsible for the personal information about you which we collect (the “data controller”) is ExtraCare.
The lawful basis for using this information
Under the GDPR, we are able to process information on certain legal grounds (bases). In the case of your information, we collect and use information under the following bases: fulfilment of contract, where it is in our legitimate interest to do so, where we have a legal obligation or you have consented to the processing.
When Do We Disclose Your Personal Information?
We may share your personal information with our employees and other parties who require such information to assist us with managing the service we provide to you.
This includes but is not limited to sharing your data with the following who may in turn process your data:
- Our clients;
- The NHS;
- Your doctor;
- Pharmacies;
- Social services;
- The local authority;
- Hospitals;
- Emergency services;
- The District Nurse; or
- Specific external suppliers such as systems providers (e.g. of our rostering, H&S reporting, and financial systems), IT consultants, legal advisers, and auditors.
Also, your personal information may be disclosed:
- As permitted or required by applicable law or regulatory requirements;
- To comply with valid legal processes;
- As part of our reporting activities;
- To protect the rights and property of ExtraCare;
- During emergency situations or where necessary to protect the safety of a person or group of persons;
- Where the personal information is publicly available; or
- With your consent where such consent is required by law.
In any such a case, we will not disclose more personal information than is required in the circumstances and, except under compulsion of law, we will not disclose without your consent any legal advice which is the subject of a duty of confidence owed to you.
CORE reporting
So that the Ministry of Housing, Communities and Local Government (MHCLG) can produce statistical information, we report information to them about our lettings and shared ownership sales via the CORE (Continuous Recording) system. The information provided does not include your name or full address, but it does contain special categories of data.
The processing of this information by the MHCLG is necessary for the performance of a task in the public interest and as far as the data includes special categories, the MHCLG states that the processing is necessary for reasons of substantial public interest. The data is used to compile statistics on the use of social housing, including reviewing equality of opportunity and treatment.
Please see the CORE website for more details.
How is Your Personal Information Protected?
We endeavour to maintain physical, technical, and procedural safeguards that are appropriate to the sensitivity of the personal information in question. This includes the use of firewalls and encryption as well as other information security requirements, systems, and procedures. These safeguards are designed to protect your personal information from loss and unauthorised access, copying, use, modification, or disclosure.
Your personal information will not normally be processed outside the European Economic Area, and we may use data sharing agreements, data processing agreements and the standard contractual clauses to protect your data where it is being shared, processed, and/or transferred to outside the European Economic Area. Where it is in our legitimate interests to do so, we will take steps to ensure that suitable safeguards apply.
How Long is Your Personal Information Retained until it is Safely Destroyed?
Except as otherwise permitted or required by applicable law or regulatory requirements, we will retain your personal information only for as long as we believe is necessary to fulfil the purposes for which the personal information was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations). As a minimum that will be until one year after the expiry of the legal limitation period for bringing a legal claim against ExtraCare in respect of the services provided. However, we may notify that we will retain your personal information for a longer period for the purposes of maintaining our records of the services provided.
In most cases personal information which is maintained by ExtraCare will be deleted seven years after the discharge of all fees incurred at the end of any service we have provided to you.
Updating Your Personal Information
It is important that the information contained in our records is both accurate and current. If your personal information happens to change during the course of your relationship with us, please keep us informed of such changes.
You have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed. In some circumstances we may decide to update our record of your personal information by appending additional text without deleting the original record.
Right of Access to Your Personal Information
You can ask to see the personal information that we hold about you. If you want to review, verify or correct your personal information, please contact ExtraCare. Please note that any such communication may be required in writing.
When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you. We may charge you a fee to access your personal information; however, we will advise you of any fee in advance. If you require assistance in preparing your request, please contact us.
Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed, erased, or made anonymous in accordance with our record retention obligations and practices.
If we cannot provide you with access to your personal information, we will try to inform you of the reasons why, subject to any legal or regulatory restrictions.
Your other legal rights
Data protection legislation also provides you with certain other rights. These are not always absolute rights and must be considered in the wider scope of the legislation. These rights are:
- Right to erasure, also known as the right, to be forgotten. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. In some circumstances this is not an absolute right;
- Right to restrict processing. You have the right to ‘block’ or suppress processing of personal data. Again, this is not an absolute right and will depend on the circumstances and any other legal/statutory obligations we may have;
- Right to data portability;
- Right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); and
- Rights related to automated decision-making including profiling.
Monitoring
Some of our premises are equipped with CCTV. Where in use, CCTV cameras are there for the protection of visitors and employees and members of staff, and to protect against theft, vandalism and damage to goods and property on the premises. Generally, recorded images are routinely destroyed and are not shared with third parties unless there is suspicion of a crime, in which case they may be turned over to the police or other appropriate government agency or authority.
This section is not meant to suggest that clients will in fact be monitored or their actions subject to constant surveillance. It is meant to bring to your attention the fact that such monitoring may occur.
Can we use your information for marketing our products and services?
We would like to keep in touch with you about all of the services and products that are exclusively available to our residents; we may do this by post, face to face, telephone or email. We promise not to fill your inbox with junk and will only contact you about things we really think will be of interest to you and if it is within our legitimate interests to do so. You can opt out from receiving these at any time by either using the unsubscribe link in the message or by contacting us directly.
It’s also really important to us that we understand what you love and what you think we could be doing better. Occasionally we send out surveys to our residents to give them the opportunity to feedback to us. We usually send these by email but may occasionally write or call you for your feedback. If you would rather not receive these surveys let us know and we will opt you out.
ExtraCare, and the specialist companies we work with, process data in order to ask for your feedback. Decisions about what information to send based on your profile, for example your age if we are letting people know about age-related services.
We use Meta Pixel on our website to understand and deliver ads tailored to your interests on Facebook. This technology allows us to measure the effectiveness of our advertising by understanding the actions users take on our website. The data collected by Meta Pixel is anonymous and does not contain personally identifiable information. By using our website, you consent to the use of Meta Pixel for these purposes. For more information on how Facebook collects and uses data, please review Facebook’s Data Policy.
We will always let you know that you can opt out from receiving marketing material and you can let us know at any time if you no longer wish to receive direct marketing offers from us. You can do so by emailing us here, or writing to us at marketing@extracare.org.uk
We will have regard to the ICO’s code of Practice on Direct Marketing in determining our approach. We will respect people’s choices not to receive direct marketing from us. We will not use ‘bought in’ lists of potential targets unless the respective individuals on the lists have consented to their data being shared with ExtraCare for the relevant purpose beforehand and will ensure we have either specific consent, or that we can rely on the ‘soft opt in’ for any electronic marketing communications we send to customers or potential customers redacting information about third parties.
The information processed to check your identity and to fulfil your request is only used for these purposes and is kept securely.
How to contact us
If you have any questions, concerns, or complaint in respect of data protection and this privacy notice, please do not hesitate to contact us. You may contact our Data Protection Officer at:
Address: 7 Harry Weston Road
Binley Business Park
Coventry
CV3 2SN
Email: privacy@extracare.org.uk
Web: www.extracare.org.uk
Tel: 024 76 506011
We will endeavour to address your issue as swiftly as possible.
We recognise that we have an ongoing responsibility for transparency with data subjects, so we keep this Notice under regular review and therefore encourage you to check it regularly. We will include a notification on our website’s home page if we make any significant changes to this privacy notice.
You can also contact the Information Commissioners Office (ICO) https://ico.org.uk/, the UK’s regulator for data protection, and raise any concerns regarding our processing of your personal data. Wycliffe House, Water Lane, Wilmslow SK9 5AF 0303 123 1113.