Data Subject Rights Requests Privacy Statement

1. Purpose of our privacy statement
1.1 Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.

2. Who are we?
2.1 Sanctuary LumaLiving is a brand name used by Sanctuary Home Care Limited and Sanctuary Housing Association, each a part of Sanctuary Group (“Sanctuary”). We are one of the UK’s leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.

3. Our data protection officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
3.2 If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.

4. Why are we collecting your information?
4.1 Data protection laws aim to empower individuals and give them greater control over their personal data through several rights including:
• Right of access – referred to by Sanctuary as a DSAR (Data Subject Access Request), gives individuals the right to obtain a copy of their personal data from us, as well as other supplementary information.
• Right to rectification – to have inaccurate personal data rectified, or completed if it is incomplete. This right is not absolute and in certain circumstances we can refuse a rectification request.
• Right to erasure – the right to have their personal data erased. This right is not absolute and in certain circumstances we can refuse an erasure request.
• Right to restrict processing – to restrict the processing of their personal data. For example, Sanctuary could continue to store personal data but not use it. This right is not absolute and in certain circumstances we can refuse a request.
• Right to data portability – to obtain and reuse their personal data for their own purposes across different services. The right only applies to information an individual has provided to Sanctuary and where the lawful basis for processing is consent or performance of a contract. Paper records are excluded from this right.
• Right to object – the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing. The right effectively allows individuals to stop or prevent organisations from processing their personal data, though is not absolute and in certain circumstances we do not have to comply.
• Rights related to automated decision making and profiling – restricts organisations from making solely automated decisions, by enabling individuals to request human intervention or challenge a decision that has been made.
4.2 Sanctuary is committed to protecting the rights of data subjects and ensuring compliance with all applicable data protection laws in the UK. The information we collect, and process will be used to administer your data subject rights request.

5. What information are we collecting?
5.1 To facilitate your request, we will collect and process the following information:
• Name
• Contact details, such as address, email address and telephone number
• Identification documentation
• Details of the scope of request
• Third party authority data (where applicable)

6. What is our lawful basis for using your information?
6.1Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

7. Sharing your information
Members of Sanctuary Group
7.1 Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to facilitate your request.
7.2 For more information on which companies make up Sanctuary Group, please go to www.sanctuary.co.uk/about-sanctuary.
Regulators and other legal obligations
7.3 We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them, for example if you raise a complaint with the Information Commissioners Office about the handling of your request.
Other organisations
7.4 We may share your information with other organisations where relevant in order to comply with your request of erasure, restriction, objection or rectification where we had previously shared that information with our partner organisations.

8. Can we use your information for any other purpose?
8.1 In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.

9. Security of your information
9.1 The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
9.2 Only relevant members of staff will access the information you provide to us.

10. Storing your information and deleting it
10.1 We will not keep your personal data for longer than we need it or are required to by law
10.2 Following completion of your request or any subsequent complaint to the Information Commissioners Office, the case file will be retained for one year before deletion.

11. Your rights
11.1 In relation to the information which we hold about you, you are entitled to:
11.2 Ask us for access to the information;
11.3 Ask us to rectify the information where it is inaccurate or is incomplete;
11.4 Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
11.5 Ask us to limit and restrict what we do with your information;
11.6 Object to our use of your information and ask us to stop that use;
11.7 Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
11.8 Our obligations to comply with the above rights are subject to certain exemptions.
11.9 To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.

12. How to complain
12.1 If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
12.2 You also have the right to complain to the Information Commissioner’s Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.