Communications and Marketing – Use of photos, videos, personal experiences Privacy Statement

1. Purpose of our privacy statement
1.1 Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.

2. Who are we?
2.1 Sanctuary LumaLiving is a brand name used by Sanctuary Home Care Limited and Sanctuary Housing Association, each a part of Sanctuary Group (“Sanctuary”). We are one of the UK’s leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.

3.Our data protection officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
3.2 If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.

4.Why are we collecting your information?
4.1 Information you provide to us is voluntary and will be used to support our communication and marketing activities. This may include promotional materials, press releases, social media posts, case studies and corporate documents.
4.2 Our materials may be published internally within Sanctuary as well as externally to our residents, on our social media channels and our websites.

5.What information are we collecting?
5.1 We currently collect and process the following information:
Sanctuary Group
Issue date:12/04/2026
Ref: PS-LL03 v1.0

Name

Age/Date of birth

Contact details including your email, phone number and your address; and

Photos, videos or audio recordings (if applicable)

Personal experiences (if applicable)
5.2 If you choose to provide it, some of the information which we collect may be special
categories of personal data (also called sensitive personal data), which includes the
following information:

Health-related information, including disability

Sexual orientation

Racial or ethnic origin; and

Religious beliefs

6.What is our lawful basis for using your information?
6.1 Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this
information is:
(a) You have given your consent. You can remove your consent at any time by contacting communications@sanctuary-housing.co.uk.
6.2 In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(a) Explicit consent

7.Sharing your information
Members of Sanctuary Group
7.1 Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate our marketing and communication activities.
7.2 For more information on which companies make up Sanctuary Group, please go to www.sanctuary.co.uk/about-sanctuary.
Contractors and sub-contractors
7.3 It may be necessary to share information about you with our contractor and subcontractors, for example with an external design, website or digital agency, when
creating our marketing materials. Our contractors and sub-contractors are
Sanctuary Group
Issue date:12/04/2026
Ref: PS-LL03 v1.0
contractually required to ensure that they adhere to the security requirements imposed by the Data Protection Act 2018 and the UK GDPR.
7.4 Our contractors and sub-contractors will not share your information with any other parties and will only be able to use the information when completing work on behalf of us.
Regulators and other legal obligations
7.5 We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
7.6 With your consent we may from time to time share your images and information provided with our partners to support our communication and marketing activities.
Data processors and Transfers
7.7 To facilitate our communication and marketing activities, information is shared with the following categories of data processors who process information on Sanctuary’s behalf:

Photographers and videographers;

Website and digital agencies;

Marketing and PR agencies;

Media organisations;

Printing companies;

System providers (in circumstances of technical IT support)

8.Can we use your information for any other purpose?
8.1 In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with
information relating to that other purpose before using it for the new purpose.

9. Security of your information
9.1 The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
9.2 Only relevant members of staff will access the information you provide to us.
Sanctuary Group
Issue date:12/04/2026
Ref: PS-LL03 v1.0

10. Storing your information and deleting it
10.1 We will not keep your personal data for longer than we need it or are required to by law.
10.2 We will retain the information you provide for 5 years, unless you contact us to withdraw consent earlier than this date.
10.3 We may from time to time seek to ‘refresh’ your consent, at which point we would retain your information for a further 5 years from the date consent was refreshed.

11. Your rights
11.1 In relation to the information which we hold about you, you are entitled to:
11.2 Ask us for access to the information.
11.3 Ask us to rectify the information where it is inaccurate or is incomplete.
11.4 Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it.
11.5 Ask us to limit and restrict what we do with your information.
11.6 Object to our use of your information and ask us to stop that use.
11.7 Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order to transmit the data to another data controller.
11.8 Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected.
11.9 Our obligations to comply with the above rights are subject to certain exemptions.
11.10 To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.

12. How to complain
12.1 If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
12.2 You also have the right to complain to the Information Commissioner’s Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF