Sanctuary Privacy Statement

Why are we collecting your information?

Basic application information

The information that you provide to us on the form(s) relating to your application is required by Sanctuary in order for us to assess your need for housing. This will include basic identifier information about you and other members of your household, contact details, and information about any relevant health conditions or specific needs that our staff should be aware of when processing your application. We need to collect this information because without it we will not be able to enter into a contract with you.

Account management information

If you are offered a tenancy, Sanctuary may invite you to answer some questions on your personal and financial circumstances for use in our Account Management Process.

This information will be used to complete our Account Management Process, which will allow Sanctuary to offer tailored services related to your rent account.

Equality and diversity information

Before or during your tenancy Sanctuary may invite you to share data on your diversity characteristics.

This is voluntary, and we ask for this data for reasons including, an ambition to improve our services and to comply with external reporting requirements.

Collecting equalities data is also part of Sanctuary’s Equality Strategy: Inclusion for All and is therefore a core element of governance and making sure that we listen and respond to your needs, promote your interests and enhance trust within our community. This can include making reasonable adjustments in specific circumstances to ensure a particular applicant’s support needs or accessibility requirements are respected and met, or it can mean implementing positive action initiatives and using data to improve our policies, procedures and services more generally.

Sanctuary also collects and uses data on characteristics such as ethnicity, disability and gender re-assignment to protect people from unlawful discrimination and it is a requirement of the Regulator of Social Housing to record and report the diversity characteristics of applicants and tenants where this information has been provided to us.

Some of the information we collect is provided by a third party such as your current or previous landlord, support services, local authorities, or health professionals where they are legally entitled to share this information with us.

What information are we collecting?

We currently collect and process the following information:

• Name
• Contact Details
• Date of Birth
• Household Member Details
• Financial / Benefits Information
• Tenancy Data
• Gender
• Personal circumstances and lifestyle details i.e., vulnerabilities/support requirements, reason for moving, pet details, proof of pregnancy (if applicable)
• Signature
• ID Documentation
• Occupation Details
• Immigration Status

Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:

• Criminal Convictions and Offences Data
• Equality / Diversity data
• Health / Disability data
• Racial or ethnic origin

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:

(b) Performance of contract

(c) Compliance with a legal obligation.

(f) Our legitimate interests or that of a third party.

In accordance with Article 9 (UK GDPR) the conditions we rely on for processing special categories of personal data are:

(b) Employment, social security and social protection law

(g) Reasons of substantial public interest.

Our basis in Law is Section 8 of Schedule 1, of the Data Protection Act 2018.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Other organisations

We may from time to time share your information with other organisations where this is lawfully permitted including, but not limited to:

• Home Office
• Other Housing Associations
• Local Authorities
• Health Professionals

Data processors and Transfers

When your application includes consideration of any health or disability related matters, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:

• Occupational therapists

We also use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.

This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.

For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

If your application is unsuccessful or cancelled your information will be retained for six months following the outcome.

If you take up a tenancy with Sanctuary, we will retain your information for six years following the end date of your tenancy.

Why are we collecting your information?

Basic tenancy information

The information that you provide to us during the course of your tenancy is required by Sanctuary in order for us to provide you with our basic services under your tenancy agreement. This will include basic identifier information about you and other members of your household, contact details, and information about any relevant health conditions or specific needs that our staff should be aware of when performing housing and maintenance services for you. We need to collect this information because without it we will not be able to enter into or maintain a contract with you.

Account management information

Before or during your tenancy, Sanctuary may invite you to answer some questions on your personal and financial circumstances for use in our Account Management Process.

This information will be used to complete our Account Management Process, which will allow Sanctuary to offer tailored services related to your rent account.

Equality and diversity information

Before or during your tenancy Sanctuary may invite you to share data on your diversity characteristics.

This is voluntary and we ask for this data to improve our services and to comply with external reporting requirements.

Collecting equalities data is also part of Sanctuary’s Equality Strategy: Inclusion for All and is therefore a core element of governance and making sure that we listen and respond to your needs, promote your interests and enhance trust within our community. This can include making reasonable adjustments in specific circumstances to ensure a particular applicant’s support needs or accessibility requirements are respected and met, or it can mean implementing positive action initiatives and using the data we collect to improve our policies, procedures and services more generally.

Sanctuary also collects and uses data on characteristics such as ethnicity, disability and gender re-assignment to protect people from unlawful discrimination and it is a requirement of the Regulator of Social Housing to record and report the diversity characteristics of tenants where this information has been provided to us.

In certain scenarios we may also receive information about you from a third party such as support services, the police, local authorities or health professionals where they have an appropriate legal basis for sharing your information.

Purposes your information will be used for

• It will allow us to comply with our legal duty to make reasonable adjustments to our services to meet the needs of our residents, for example by providing accessible accommodation if you are disabled;
• It will allow us to provide services which are tailored to your particular needs, for example by providing translators at appointments or meetings where English is not your preferred language;
• It will be used to improve the services you receive from us, by improving our policies, procedures and our operating model;
• It will be used to support you to effectively manage and sustain your tenancy, including, but not limited to: housing management to ensure compliance with the terms of your contract with us, management of antisocial behaviour;
• It will be used to allocate an Account Management Profile to you for rent account management;
• It will be used to provide you with welfare benefit advice;
• It will be used for the arrangement and completion of repairs;
• It will be used for the fulfilment of our regulatory and legislative requirements, and specifically our obligations in terms of compliance and health and safety;
• It will allow us to make contact with you in the most appropriate way. For example, we can provide literature in large print if you have difficulty reading smaller print; or provide documents in an alternative language if English is not your preferred language; and
• It will be used to report anonymously to our key internal stakeholders to ensure that our services are inclusive, meet peoples’ needs and are not discriminatory. For example, by reviewing anonymous customer complaints by age or disability we can ensure that certain groups of tenants are not disproportionately dissatisfied with our service, or subject to discrimination.
• An understanding of your personal situation and individual needs will help us to provide a tailored service that meets any physical, cultural or financial needs that you may have.
• To provide support in applying for a TV licence where requested.

In circumstances where we may wish to use your personal data to help us improve our services for you (including, but not limited to, involvement in our resident scrutiny processes), we will seek your consent.

What information are we collecting?

We currently collect and process the following information where applicable:

• Name
• Age / Date of birth
• Contact details
• Next of kin details
• Household details
• Occupation
• Financial / Benefit Information
• Rent – related documents
• ID documentation
• Gender
• Antisocial behaviour details (where applicable)
• Tenancy matters and breaches
• Marital status
• Personal circumstances, preferences and lifestyle details e.g. vulnerabilities/support requirements, reason for name change, reason for leaving previous property, pet details, proof of pregnancy (where applicable)
• Signature
• Immigration / right to rent status
• Personal opinions / exit survey – following the end of your tenancy.

Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:

• Criminal Convictions / Offence Data / Court Orders
• Equality / Diversity data
• Health / Disability data
• Racial or ethnic origin
• Sexual Orientation

Some of the information we collect is provided by a third party where they are legally entitled to share this data with us, including :

• Local authorities
• Current and previous landlords
• Support agencies
• Police / Emergency Services
• Home Office
• Department for Work and Pensions (DWP) - Universal Credit
• Health professionals

If you don’t provide the information listed above, we may not be able to enter into a contract with you or provide you with the full range of services on offer which will limit the support we can give.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:

(b) Performance of a contract

(c) Compliance with a legal obligation

(f) Our legitimate interests or that of a third party.

In accordance with Article 9 (UK GDPR) the conditions we rely on for processing special categories of personal data are:

(b) Employment, social security and social protection

(f) Legal claims or judicial acts

(g) Reasons of substantial public interest.

Our bases in Law for the above processing are Section 1, 8 and 10 of Schedule 1, of the Data Protection Act 2018.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

Your information will only be accessed by other companies in the Group where it is necessary to do so in order to provide services to you in accordance with our contract. The obligations which are set out in this notice shall apply to the other members of the Group to the same extent that they apply to us.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Other organisations

We may from time to time share your information with other organisations, where this is legally permitted, including, but not limited to:

• Utility companies so they can provide services to you and contact you in respect of utility charges;
• The police for the purpose of detection and prevention of crime;
• Organisations such as local government, with a function of auditing and / or administering public funds for the purpose of detection and prevention of fraud or reduction of homelessness;
• Regulatory, statutory and / or voluntary bodies with a function of providing support and social care;
• Court services in relation to formal tenancy enforcement action;
• Public Trustee in relation to the termination of a tenancy where there is no next of kin or Executor;
• Individuals or organisations who have been granted third party authority or power of attorney;
• Property management companies to deliver services in keeping with the specific terms of the housing management contract.
• Local authority teams where this is necessary in relation to our responsibilities to you as a landlord, such as environmental health.
• If requested, we will share your information with TV Licensing or the Post Office in order to set up a TV licence for you.

Hardship funds

We will share your first and last name, email address and telephone number with e-vouchers for the purpose of providing you with vouchers that you can redeem towards your energy bill or for cash.

Data Processors - Contractors and sub-contractors

To facilitate the delivery of services to you, it may be necessary to share information about you with our contractors and sub-contractors in order to provide you with housing services in accordance with the tenancy or licence agreement in place between us.  We will only share your information about you with contractors and sub-contractors where it is relevant and necessary to address your individual needs. Our contractors and sub-contractors shall be contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.

Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on our behalf.

We use the following categories of data processors:

• Maintenance contractors
• Communications and Messaging service providers
• Environmental and community safety providers   

Data Transfers

We also use a third-party processor for technical IT support with our internal systems, who may transfer your data outside the UK to India.

This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.

For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law. Once you are no longer a resident of ours your information will be retained for six years following the end of your tenancy.

Why are we collecting your information?

To facilitate your booking of a communal and / or guest room at one of our Housing for Older People Schemes.

What information are we collecting?

We currently collect and process the following information:

Communal Room Hire:

• Name of hirer
• Position held within organisation (charitable/welfare groups) if applicable
• Telephone number
• Email address
• Signature
• Financial / payment information if applicable

Guest Room Hire:

• Resident name and address visiting
• Dates of stay
• Visitor name, address, contact number and email address
• Financial / payment information
• Reason for stay
• Resident and visitor signature

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(b) Performance of a contract.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

We will keep information relating to your booking for six years following your stay or room hire.

Why are we collecting your information?

Sanctuary uses Video Surveillance Management Systems (commonly known as CCTV) to help reduce the fear or threat of crime, to protect customers, staff, our premises, fixtures, fittings, and property.

Video surveillance images will be used to:

• Assist in the prevention and detection of crime
• Facilitate the identification, apprehension and prosecution of offenders in relation to crime;
• Ensure the security of the Group’s customers, employees, visitors and property;
• Facilitate appropriate door and site access;
• Reduce incidences of vandalism and criminal damage; and
• Enhance the feeling of security provided to customers, staff, and visitors.

What information are we collecting?

We collect and process video surveillance images. These images may reveal or enable the inference of special categories of data (also called sensitive personal data), such as any disability or health conditions, racial or ethnic origin as well as religious beliefs.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(f) Our legitimate interests or that of a third party – for the purposes of prevention and detection of crime.

In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:

(g) Reasons of substantial public interest.

Our basis in Law is Section 10 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of the prevention or detection of an unlawful act.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to information by law and with other organisations where we have a legal obligation to share the information with them.

Other organisations

We may from time to time share your information with other organisations, such as:

• Insurance companies or solicitors, in connection with any claims where evidence of video surveillance footage is required.

Data processors and transfers

To facilitate this process, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:

• Security companies that are responsible for on-site security (where applicable).

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

We retain video surveillance footage for 28 days at which point the information is automatically deleted.

Why are we collecting your information?

The information that you provide to us when you sign up to our mailing lists is required to send you news, event details, offers and information emails about Sanctuary and the services we provide. It is completely voluntary whether you provide us with your information.

You can unsubscribe from our emails at any time, and we will delete your details from our database.

What information are we collecting?

To enable us to provide you with marketing emails, we will need your name and email address.

We will also collect information about how you interact with those emails; whether you open them or not, at what time, if you mark them as spam, whether you click on a link and whether you unsubscribe.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(a) You have given your consent. You can remove your consent at any time, by contacting online.marketing@sanctuary.co.uk.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Data processors and Transfers

We use a third-party platform, Campaign Monitor, for some of our email campaigns. Campaign Monitor is a global business that is headquartered in Australia and uses a data centre located in the United States of America so their processing of your personal data will involve a transfer of data outside the UK.

Whenever we or one of our data processors transfer your personal data outside of the UK in this way, we ensure a similar degree of protection is afforded to it by ensuring that specific contractual clauses are implemented which give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used when your personal data is transferred outside of the UK.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

We will store the personal data which you provide to us for as long as our products or services match the interest you expressed and for as long as you continue to provide consent.

Why are we collecting your information?

Information you provide to us is voluntary and will be used to support our communication and marketing activities. This may include promotional materials, press releases, social media posts, case studies and corporate documents.

Our materials may be published internally within Sanctuary as well as externally to our residents, on our social media channels and our websites.

What information are we collecting?

We currently collect and process the following information:

• Name
• Age/Date of birth
• Contact details including your email, phone number and your address; and
• Photos, videos or audio recordings (if applicable)
• Personal experiences (if applicable)

If you choose to provide it, some of the information which we collect may be special categories of personal data (also called sensitive personal data), which includes the following information:

• Health-related information, including disability
• Sexual orientation
• Racial or ethnic origin; and
• Religious beliefs

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(a) You have given your consent. You can remove your consent at any time by contacting communications@sanctuary-housing.co.uk.

In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:

(a) Explicit consent

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate our marketing and communication activities.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Contractors and sub-contractors

It may be necessary to share information about you with our contractors and sub-contractors, for example with an external design, website or digital agency, when creating our marketing materials. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.

Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Other organisations

With your consent we may from time to time share your images and information provided with our partners to support our communication and marketing activities.

Data processors and Transfers

To facilitate our communication and marketing activities, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:

• Photographers and videographers;
• Website and digital agencies;
• Marketing and PR agencies;
• Media organisations;
• Printing companies;
• System providers (in circumstances of technical IT support)

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

We will retain the information you provide for 5 years, unless you contact us to withdraw consent earlier than this date.

We may from time to time seek to ‘refresh’ your consent, at which point we would retain your information for a further 5 years from the date consent was refreshed.

Why are we collecting your information?

Data protection laws aim to empower individuals and give them greater control over their personal data through several rights including:

• Right of access – referred to by the Group as a DSAR (Data Subject Access Request), gives individuals the right to obtain a copy of their personal data from us, as well as other supplementary information.
• Right to rectification – to have inaccurate personal data rectified, or completed if it is incomplete. This right is not absolute and in certain circumstances the Group can refuse a rectification request.
• Right to erasure – the right to have their personal data erased. This right is not absolute and in certain circumstances the Group can refuse an erasure request.
• Right to restrict processing – to restrict the processing of their personal data. For example, Sanctuary could continue to store personal data but not use it. This right is not absolute and in certain circumstances the Group can refuse a request.
• Right to data portability – to obtain and reuse their personal data for their own purposes across different services. The right only applies to information an individual has provided to Sanctuary and where the lawful basis for processing is consent or performance of a contract. Paper records are excluded from this right.
• Right to object – the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing. The right effectively allows individuals to stop or prevent organisations from processing their personal data, though is not absolute and in certain circumstances the Group does not have to comply.
• Rights related to automated decision making and profiling – restricts organisations from making solely automated decisions, by enabling individuals to request human intervention or challenge a decision that has been made.

Sanctuary Group is committed to protecting the rights of data subjects and ensuring compliance with all applicable data protection laws in the UK. The information we collect, and process will be used to administer your data subject rights request.

What information are we collecting?

To facilitate your request, we will collect and process the following information:

• Name
• Contact details, such as address, email address and telephone number
• Identification documentation
• Details of the scope of request
• Third party authority data (where applicable)

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(c) Compliance with a legal obligation – using your information is necessary for us to comply with a legal obligation to which we are subject in accordance with UK data protection law.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate your request.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them, for example if you raise a complaint with the Information Commissioners Office about the handling of your request.

Other organisations

We may share your information with other organisations where relevant in order to comply with your request of erasure, restriction, objection or rectification where we had previously shared that information with our partner organisations.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

Following completion of your request or any subsequent complaint to the Information Commissioner's Office, the case file will be retained for one year before deletion.

Why are we collecting your information?

To enable residents and the public to raise enquiries and/or seek information about our services.

If your enquiry relates to a service failure, the information that you provide will also be used for the purpose of improving our products and services.

What information are we collecting?

The information that we collect about you will include your name and contact details, and any other information which you provide to us via email, social media message, telephone, live chat or by completing an enquiry form from our website.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(f) Our legitimate interests or that of a third party in enabling residents and the public to engage with Sanctuary on the services available, seek information and /or support.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to answer or resolve your query.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Contractors and sub-contractors

It may be necessary to share information about you with our contractors and sub-contractors to resolve your enquiry, for example if you report a fault and require a repair. Our contractors and sub-contractors are contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.

Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Data processors and Transfers

To facilitate enquires through our website and social media channels the following categories of data processors process information on Sanctuary’s behalf:

• Website hosting partner
• Social media management providers

One of our social media management providers, Hootsuite, uses sub-processors who may process and store information in the United States of America or other countries. Where this happens, Hootsuite has standard contractual clauses in place to ensure any information transferred has adequate protections in place and is compliant with data protection laws.

For further information about what international data transfers occur at Hootsuite please visit Privacy (hootsuite.com).

Storing your information and deleting it

Following resolution of your enquiry, your information will be retained as outlined below:

• Web forms submitted via our websites are retained for 30 days.
• Social media private messages are retained for two weeks.
• Emails are retained for a minimum of one year and are automatically deleted after three years.
• Telephone recordings are retained for 30 days. Please note not all telephone calls are recorded.

Automated decision making

An automated decision is a decision made by a computer without any human involvement in the process. We will not use automated decision making in relation to processes that would have legal or similarly significant effects.

We may, however, use automated decision making of your personal data whenever you send an email to our Repairs Customer Hub, as we currently use an email prioritisation tool that priorities emails depending on their level of urgency. Although automated decision making is used to manage the emails, there is still human intervention as staff carry out a review of the email prioritisation on a daily basis.

Why are we collecting your information?

We are required to contact you to seek your views about our services to fulfil the requirements of the Regulator of Social Housing consumer standards in England.

We will also seek your views to improve our service provision more widely.

The information you provide to us will be used for the following purposes:

• Data provided will be used to comply with the requirements of the Regulator of Social Housing consumer standards in England (for Tenant Satisfaction Measures). Any information shared will be anonymised.
• To identify service failure and improve our services more widely. Information may be passported to other parts of Sanctuary to address the specific service failure identified.
• Creating broad customer profiles to provide the most effective service based upon need.

What information are we collecting?

The information we collect is about your views of our service, in some cases when you have directly experienced them e.g. when we have done a repair at your home, how satisfied you are and why.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:

(c) Compliance with a legal obligation (for example, the Regulator of Social Housing consumer standards);

(f) Our legitimate interests or that of a third party in addressing a specific service failure or improving our services more widely.

Sharing your information

Members of Sanctuary Group

Sanctuary is made up of several related companies. We will share your information with other members of the Group where necessary to address a specific service failure.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Data Processors and Transfers

This process is supported and facilitated by an appointed market research contractor, which we require to comply with the Data Protection Act 2018, UK GDPR and the Market Research Society standards.

Our contractor will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.

We will not be transferring your information abroad for this purpose. All information will be held in the UK.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

Information related to tenant satisfaction surveys will be retained for 3 years following completion of the survey.

Why are we collecting your information?

Sanctuary aims to provide good quality homes and to deliver high quality services. To understand how we are doing and where we could make improvements, we would like to seek your experiences of our services.

Where applicable your information will also be used for processing expense claims.

Information may be passported to other parts of Sanctuary to address any specific service failures identified.

What information are we collecting?

The information we collect is about your experience of our service, which may include how satisfied you are and why.

To facilitate this, we may process the following information:

• Name
• Address
• Contact details
• Age
• Financial details
• Tenure type
• Gender

To monitor and ensure the equality of our services we may also process special categories of personal data (also called sensitive personal data), including:

• Ethnicity
• Health and Disability
• Sexual orientation

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(a) You have given your consent. You can remove your consent at any time. You can do this by contacting scrutiny@sanctuary.co.uk.

In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:

(g) Reasons of substantial public interest.  

Our basis in Law is Section 8 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the equality of opportunity and treatment.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to improve the services we provide and to address a specific service failure if applicable.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Data processors and Transfers

We may use a third-party experience management platform to facilitate some of our customer experience surveys. This platform is supported by the software provider who we may share your information with for the purposes of providing technical IT support to address system issues.

We also use a third-party processor for technical IT support with our internal systems, who may transfer your data outside the UK to India.

This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.

For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

Responses to customer engagement activities may be retained for up to 3 years following participation.

Why are we collecting your information?

Understanding your needs is crucial for us to be able to tailor our services for you. The data we collect through Sanctuary Census is to make sure we have an up to date understanding of you so we can do this effectively, supported by the creation of broad customer profiles to provide the most effective service based upon need.

Where issues of service failure are identified during this process this information will be used to address the issue as well as improve our services more widely.

What information are we collecting?

The information we collect is about you and others who live in your home. We will collect and process the following information:

• Contact details and how you prefer us to contact you

We will additionally collect and process the following optional information about you and others who live in your home that can be provided on a voluntary basis:

• Gender
• Main language
• Marital status
• Nationality
• Membership of armed forces (if applicable)

Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following optional information that can be provided on a voluntary basis:

• Disability and Health
• Race
• Ethnic Origin
• Religious and/or philosophical beliefs
• Sexual Orientation
• Gender reassignment

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful bases we rely on for processing this information are:

(c) Compliance with a legal obligation - as we are subject to the Regulator of Social Housing consumer standards.

(f) Our Legitimate interests or that of a third party – where issues of service failure and opportunities for improvement are identified as well as the creation of broad customer profiles to provide the most effective service.

In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:

(d) Not-for-profit bodies.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Data processors and Transfers

To support this process, we use third-party processors who provide the system used to collate the information as well as technical IT support for the systems used to store the information.

Our technical IT support partner may transfer your data outside the UK to India.

This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement (Standard Contractual Clauses) issued by the Information Commissioner’s Office.

For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

Responses will be retained for three years following the closure of the census.

Why are we collecting your information?

Sanctuary aims to provide good quality homes and deliver high quality services. However, it is recognised that there may be times when something goes wrong, or customers are dissatisfied.

The information you provide will be used to process, investigate, and respond to your complaint.

It will also be used to identify service failure and improve our services more widely. Information may be passported to other parts of Sanctuary to address the specific service failure identified.

We may also receive personal information indirectly, from the Housing Ombudsman or your Member of Parliament if you have raised the matter with them, as well as our contractors as part of our investigation.

What information are we collecting?

We collect and process the following information:

• Name
• Contact details
• Complaint details
• Third party authority (if applicable)
• Financial / bank details (if applicable for the payment of a goodwill gesture or compensation).

Depending on the nature of your complaint, some of the information which we collect may be special categories of personal data (also called sensitive personal data), including information relating to your health.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(f) Our legitimate interests or that of a third party, enabling customers to raise a complaint, identify and address failures in service.

In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:

(a) Explicit consent.

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of a number of related companies. We will share your information with other members of Sanctuary Group where necessary to investigate and resolve your complaint.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

We may share your information with the Housing Ombudsman if you have raised a complaint with them about Sanctuary to support this process.

Other Organisations

Where issues of service failure have been identified, it may be necessary to share information about you with our contractors and sub-contractors in order to address this, for example where a repair has not been completed or to your satisfaction. We will only share your information about you with contractors and sub-contractors where it is relevant and necessary to address your individual needs.

Data Transfers

We use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.

This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.

For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law.

Information relating to complaints raised by tenants, will be retained for 6 years following the end of your tenancy.

​​​​​​​Complaints raised by members of the public will be retained for 5 years following closure of the complaint.

​​​​​​​Financial Information relating to payments of compensation and gestures of goodwill will be retained for 6 years from the end of the last financial year they relate.

Why are we collecting your information?

New Court is a retirement community exclusively for the over 65s. The information that you provide to us will be used to ensure you meet this criteria and provide the services under your contractual agreement with us.

Without this information, we will not be able to enter into a contract with you or provide the full range of services on offer which will limit the support we can give you.

What information are we collecting?

We collect and process the following information:

• Name
• Address
• Contact details
• Date of Birth
• Gender
• Emergency contact details including their relationship to you
• Preferred language
• Financial Information, including direct debit mandate

Some of the information which we collect will be special categories of personal data (also called sensitive personal data), which includes the following information:

• Health information, including any serious medical conditions you have, medication details as well as if you receive support from carers.

What is our lawful basis for using your information?

Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:

(b) Performance of a contract

In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:

(a) Explicit consent

Sharing your information

Members of Sanctuary Group

Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to best provide the services to you.

For more information on which companies make up Sanctuary Group, please go to About Sanctuary.

Regulators and other legal obligations

We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Other organisations

We will not share your information with other organisations without your consent, except in emergency and potentially lifesaving situations.

Data Transfers

We use a third-party processor, for technical IT support with our internal systems, who may transfer your data outside the UK to India.

This transfer is made in accordance with Article 46 of the UK GDPR as we have ensured a similar degree of protection is afforded to it through our processor implementing an International Data Transfer Agreement.

For further information on the safeguards implemented, or to access a copy please email dataprotection@sanctuary.co.uk.

Storing your information and deleting it

We will not keep your personal data for longer than we need it or are required to by law. Once you are no longer a resident of New Court your information will be retained for six years.