Health and Safety – Accident & Incident Reporting –Privacy Statement

1. Purpose of our privacy statement
1.1 Under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we are required to explain to you why we are asking for this information about you, how we intend to use the information you provide and whether we will share this with anyone else.

2. Who are we?
2.1 Sanctuary LumaLiving is a brand name used by Sanctuary Home Care Limited and Sanctuary Housing Association, each a part of Sanctuary Group (“Sanctuary”). We are one of the UK’s leading providers of housing, care and commercial services. Our address is Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ.

3. Our data protection officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws.
3.2 If you have any concerns or questions about our use of your personal data, you can contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.

4. Why are we collecting your information?
4.1 Sanctuary uses your personal information to monitor and manage the health and safety of members of the public, customers and staff who have had an accident or incident whilst working or accessing Sanctuary services, land or buildings, as required by the Health and Safety at Work Act 1974 and subsidiary regulations. The processing of your information is necessary for compliance with the legal obligations contained in this Act.
4.2 We will use your personal information in one or more of the following circumstances:
• where you report an accident, injury or incident or where an accident injury or incident occurs involving you.
• where it is necessary to ensure your safety
• where you have witnessed an accident or incident.
• to maintain accurate and up-to-date accident, injury and incident records.
• investigate accidents and incidents to minimise the chance of reoccurrence.
• fulfil our legal obligations under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
• fulfil our legal obligations under the Management of Health and Safety at Work Regulations
• enable us to establish, exercise or defend possible legal claims both criminal and civil.

5. What information are we collecting?
5.1 We currently collect and process the following information:
• your contact details, including the following:
o your name
o address
o telephone number
o personal e-mail address
• age and/or date of birth
• data entered on accident and incident report forms
• video recordings of incidents (if applicable)
• photographs of an injury sustained (if applicable)
5.2 Some of the information which we collect may be special categories of personal data (also called sensitive personal data), including specific information relating to any injuries, ill health or their progression because of an accident or incident.

6. What is our lawful basis for using your information?
6.1 Under Article 6 of the UK GDPR, the lawful basis we rely on for processing this information is:
(c) Compliance with a legal obligation – Using your information is necessary for us to comply with a legal obligation to which we are subject in accordance with the Health and Safety at work Act 1974 and Diseases and Dangerous Occurrences Regulations 2013.
6.2 In accordance with Article 9 (UK GDPR) the condition we rely on for processing special categories of personal data is:
(b) Employment, social security and social protection.
6.3 Our basis in Law is Section 1 of Schedule 1, of the Data Protection Act 2018 as the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection.
7. Sharing your information
Members of Sanctuary Group
7.1 Sanctuary Group is made up of several related companies. We will share your information with other members of Sanctuary Group where necessary to meet our health and safety obligations.
7.2 For more information on which companies make up Sanctuary Group, please go to www.sanctuary-group.co.uk/about-us.
Regulators and other legal obligations
7.3 We may also be required to share your information with our regulators who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.
Other organisations
7.4 We may from time to time share your information with other organisations, such as:
• NHS and clinical teams if the accident or incident resulted in an injury and emergency assistance is required
• our insurers, in connection with any public liability claim
7.5 There may be occasions where we share information with the Health and Safety Executive; this is a legal requirement under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013.
7.6 In accordance with the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations Act 2013 we are required to report on the following:
• fatal accidents.
• accidents to non-workers (members of the public and customers) arising out of a work activity requiring the individual to attend hospital for treatment.
Data processors and Transfers
7.7 To facilitate our health and safety obligations, information may be shared with our IT platform provider for the purposes of technical system support and troubleshooting.

8. Can we use your information for any other purpose?
8.1 In limited circumstances, we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.

9. Security of your information
9.1 The information that you provide will be stored securely. Our technological and organisational security measures and procedures reflect the seriousness with which we attach to the confidentiality, integrity and availability of your information.
9.2 Only relevant members of staff will access the information you provide to us.

10. Storing your information and deleting it
10.1 We will generally hold your personal information for six years from the date of any accident or incident. The exceptions are:
• if the accident or incident results in a civil claim or criminal proceedings, the information will be held for at least the duration of any claim or proceeding.
• if the accident or incident involves a child, the information will be held for three years after their 18th birthday.
• if the accident or incident results in an occupational disease, the information will be held for at least 40 years in accordance with current legislation.

11. Your rights
11.1 In relation to the information which we hold about you, you are entitled to:
11.1.1 Ask us for access to the information;
11.1.2 Ask us to rectify the information where it is inaccurate or is incomplete;
11.1.3 Ask us to erase the information and take steps to ask others who we have shared your information with to also erase it;
11.1.4 Ask us to limit and restrict what we do with your information;
11.1.5 Object to our use of your information and ask us to stop that use;
11.1.6 Ask us to provide the data you have provided us in a structured, commonly used, and machine-readable format (for example, a CSV file) in order transmit the data to another data controller.
11.1.7 Where we are using your information because you have provided your consent to that use, you are entitled to withdraw your consent at any time. The lawfulness of our use of your information before consent was withdrawn is not affected;
11.1.8 Challenge the decision of any automated decision-making and/or profiling that is applied to your personal data as part of the processing;
11.2 Our obligations to comply with the above rights are subject to certain exemptions.
11.3 To exercise any of the rights referred to above, you should contact our Data Protection Officer by writing to The Data Protection Officer, Sanctuary House, Chamber Court, Castle Street, Worcester, Worcestershire, WR1 3ZQ or emailing dataprotection@sanctuary.co.uk.

12. How to complain
12.1 If you have any concerns about our use of your personal information, you can contact our Data Protection Team on dataprotection@sanctuary.co.uk.
12.2 You also have the right to complain to the Information Commissioner’s Office (the ‘ICO’) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.