Privacy notice for care customers - collecting and retaining personal information

We collect the following information through a variety of sources: (i) directly from you; or (ii) via a third party including:

• your full name
• your date of birth
• your contact details (phone, email or correspondence address)
• details of anyone authorised to act on your behalf if applicable
• other personal information that will vary on a case by case basis to assist us in providing services to you
• other details - next of kin details
• other details – name and contact details for GP
• other details – details of other agencies and care providers involved in the provision of your care
• equalities (including some protected characteristic data), disabilities, vulnerabilities or risks. We use this information to tailor our service to better meet your particular circumstances and needs. We may use this information for safeguarding of staff
• financial information. We may use this to act as your appointee or to help you make a decision around affordability, resolve any debts/arrears and provide welfare benefits, fuel and debt advice as a service to help you budget and pay bills
• health information when we require this to provide support in this area
• photo ID, bank statements or income details for verification purposes
• historic complaint information
• information required to provide your care package, and
• referral information from a third party, for example a local authority.

The information we may collect from you includes:

• equalities (including some protected characteristic data), disabilities or vulnerabilities. We use this information to tailor our service to better meet your particular circumstances and needs. We may use this information for safeguarding of staff
• your health number, national insurance number and any unique identifiers provided by a local authority, and
• your photo. We use your photo to identify you to care workers, letting us provide your care and support package, and keeping you safe.

We collect your personal information from you via a variety of sources, including when you complete one of our forms, when you call, write, email, meet with us or respond to a survey. We may collect information when you use our social media sites and websites.

Our landline phone calls to our Customer First Centre and to the Group Debt Recovery Team are recorded for training and monitoring purposes and our recordings are held for a period of one month.

We operate a CCTV system at some of our office premises and at various locations within the vicinity of our properties for the detection and prevention of crime, to fulfil our legal obligations to keep our staff safe and in pursuit of our legitimate basis to keep our properties safe and secure. Our CCTV cameras operate continuously and recordings are held for one month.

We may also take photographs and video footage at events we organise or take part in, at our offices and in our communities to use for general marketing and publicity. Photographs will only be used for those purposes with your consent.

We may transfer information about you to other Wheatley Group companies for purposes connected with the management of your contract with us and with Wheatley Care’s business.

We may receive information about you from third parties including:

• your Local Council, Health and Social Care Partnership or benefits office relating to your care plan
• police, welfare or support organisations dealing with you, and
• Councillors, MPs or other representatives acting on your behalf/instruction.

We do not usually process children’s information as part of your care package. However, we do record children’s basic information if they are living with you including their name, age and family structure. This is to allow us to support you as a parent or legal guardian.

We may, for example, use this information to signpost you to agencies, benefits and resources which may help your family.

We may, at a later stage, receive children’s information if we are involved in a welfare case as part of a multi-agency working solution.

We need to collect your personal information so we can provide your care package, as agreed by you and/or your legal representative. We will use your personal information to provide the agreed service to you and for any other purposes consistent with the proper performance of our operations and business. Our operations and business includes:

• working with individuals who are continuing to misuse alcohol and drugs and not ready to make changes at this time, and individuals who work with us in a harm-reduction model
• provision of our Alcohol-related Brain Damage service which supports people at a state-of-the-art development in Glasgow
• providing homelessness resettlement services
• supporting individuals with learning difficulties who live in their own tenancies
• supporting the people we work for move on from institutional care and into their own home or supporting people we work for to remain within their homes during periods of crisis
• providing a housing support and care at home service
• providing a home from hospital support for older people, enabling them to leave hospital as soon as possible, and helping them to settle back in to their homes, and
• working with young people to help them develop their skills in assessing tenancy options, obtaining and sustaining a tenancy, managing finances, creating and maintaining a safe and healthy home, maintaining a healthy lifestyle, living within a community, communicating, interacting and building relationships, dealing with conflict and developing employibility skills.

Using the personal information collected about you allows us to supply the services you have requested from us.

We are also under a legal obligation to process certain personal information relating to the people we work for, for the purposes of complying with our legal obligations under:

• Housing (Scotland) Acts 1987, 2001, 2006, 2010 and 2014
• Management of Offenders etc. (Scotland) Act 2005
• National Assistance Act 1948
• Social Work (Scotland) Act 1968
• NHS and Community Care Act 1990
• National Assistance (Assessment of Resources) Regulations 1992
• Human Rights Act 1998
• Adults with Incapacity (Scotland) Act 2000
• Regulation of Care (Scotland) Act 2001
• The Regulation of Care (Requirements as to Care Services) (Scotland) Regulations 2002
• Community Care and Health (Scotland) Act 2002
• Mental Health (Care and Treatment) (Scotland) Act 2003
• Adult Support and Protection (Scotland) Act 2007
• Equality Act 2010
• Social Care (Self-directed Support) (Scotland) Act 2013
• Public Bodies (Joint working) (Scotland) Act 2014
• Carers (Scotland) Act 2016
• Duty of Candour Procedure (Scotland) Act 2018
• Public Services Reform (Scotland) Act 2010
• The Social Care and Social Work Improvement Scotland (Requirements for Care Services) Regulations 2011
• Data Protection Act 2018
• General Data Protection Regulation (EU) 2016/679 (GDPR)
• Freedom of information (Scotland) Act 2002
• Environmental information (Scotland) Regulations 2004.

If you do not provide the information we need then we may not be able to provide all our services to you, and ultimately we may not be able to support you.

We also process your personal information in pursuit of our legitimate interests to:

• deliver our investment programme to provide appropriate facilities
• pursue any debts owed to us
• offer support services to you and those living with you if they have also been referred to us for support
• provide education, employment and training advice and opportunities
• target customers impacted by welfare reform
• issue communications to you regarding our services, including letters, newsletters, emails and texts
• analyse equality related data to help us better understand our customers’ characteristics and prioritise, tailor and target services to you This includes  informing our service design and decision-making process through Equality Impact Assessments
• publish anonymous summaries of equality data collected to show what this data has informed and to help us monitor progress, such as through the Wheatley Group Annual Equality Report
• carry out customer segmentation research to allow us to help us better understand our customers’ characteristics and prioritise, tailor and target services to you
• undertake research and statistical analysis to help improve our business processes and the services offered to our customers, as well as evaluate our performance against other benchmarks. Where possible, statistical information is anonymised or pseudonymised, and
• we may also conduct surveys regularly and periodically relating to our services in order to gauge satisfaction and make improvements based on feedback.

Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes.

If you wish to object to any of the above processing, please contact us on InformationRequests@wheatley-group.com. If we agree and comply with your objection, this may affect our ability to undertake the tasks above for your benefit.

We are required to use your personal information relating to your health, racial or ethnic origin for equality monitoring purposes as required by government departments and agencies, Care Inspectorate and auditors and with other organisations and agencies where we are legally allowed to do so.

We also may collect equality and protected characteristic data to support our Equity, Diversity and Inclusion approach. We will process such personal information to identify and keep under review the existence or absence of equity of opportunity or treatment between groups of people within the same categories to promote or maintain equity within our Group.

We offer a number of additional voluntary services to the people we work for including organising community events, fire safety visits, providing debt advice and adapting the property you live in.

For these voluntary services, where your personal information is needed, we will always notify you about the service being offered, explain the service and obtain your consent or use another lawful basis to proceed.

For the additional voluntary services, much of the information contained in our Privacy Notice is still relevant, such as details about the Data Controller and the rights you have under the legislation, including the right to withdraw your consent and the right to complain.

We may be required to process your personal information for additional purposes. For example, we may share your information with our translation and interpretation service provider if it is necessary to translate any information into or from a foreign language for you, or arrange an alternative format or interpretation for you.

We share limited personal data with our contractors who are carrying out services on our behalf including:

• to provide a language translation service if it is necessary to translate any information into, or from, a foreign language for you
• to our third party provider Housing Proactive, for the purpose of providing their OK Eachday service to our Livingwell customers
• to carry out research, surveys and segmentation on our behalf to help us to improve the services we offer to you
• if we are conducting a survey of our products, services, or customer base your information may be disclosed to third parties assisting in the compilation and analysis of the survey or customer segmentation results, and
• with our professional and legal advisors for the purposes of taking advice.

Our contractors are required to comply with the law and our own Data Processing Agreement or Data Processing Clauses within our contracts to ensure data is managed appropriately and for specified purposes.

In the event we enter into a joint venture or merge with another business entity, your information may be disclosed to our new business partners or owners. In such circumstances, we would consult with you about your personal information being shared with such a third party.

We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Care Inspectorate, health and social care partnerships, homelessness services, health services or care and support organisations that we work with, local authorities, government departments and agencies, with our regulator and auditors, with utility companies or with other organisations and agencies. We will only share information where there is a legal basis to do so and in accordance with UK data protection legislation.

In the event we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure recipients shall only process the disclosed personal information in accordance with those purposes.

As a customer we need to communicate with you. This will usually be in writing or by telephone, but is more commonly becoming electronic and paperless. We are moving many of our services online as this is usually more convenient for you and more efficient for us.

The people we work for receive our newsletters with information about what is going on within the organisation. We are required by our regulator under Health and Social Care Standards, published through ministers powers under section 50 of the Public Services Reform (Scotland) Act 2010 and section 10H of the National Health Service (Scotland) Act 197, to keep the people we work for informed and to offer opportunities for involvement. You may opt-out of receiving this communication by contacting info@wheatley-group.com

We will only discuss or communicate your details in relation to our services with those authorised (temporarily or permanently) by you.

Your personal information is stored on our paper and IT filing systems which may be copied for testing, backup, archiving and disaster recovery purposes. Access to your information is limited to those who require it to provide services to you. All data is held within the UK.

If any of your personal information is transferred out with the European Union or the European Economic Area by any of our contractors we will ensure there are adequate safeguards in place to protect your personal information in accordance with the General Data Protection Regulations and applicable UK Data Protection Legislation.

We will only keep your personal information for as long as necessary to provide you with housing and/or related services and to safeguard Wheatley Care in the event of any claims, complaints, litigation, enquiries or investigations during or following the termination of your tenancy. Unless you ask us not to, we will review and possibly delete your personal information where your tenancy has been terminated for seven years.

We will keep certain personal information of tenants for longer in order to confirm how long you were a tenant. We need to keep this in the event of a claim against Wheatley Care.

Unless deleted or moved to Wheatley Group systems by a Wheatley staff member, emails sent and received by Wheatley staff are automatically deleted after 6 months. Any emails which are relevant to a customer’s file are added or summarised within Wheatley Group systems.

Emails which are uploaded to Wheatley Group systems are held in accordance with the relevant section of the Wheatley Group’s retention schedules.  For example, emails relating to care provision are usually held for 6 years after the end of the care service provision.

We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods for all information we hold about your tenancy. You can request a copy by contacting us at InformationRequests@wheatley-group.com

You can exercise any of the following rights by writing to us at InformationRequests@wheatley-group.com.

Your rights in relation to your personal information are:

• you have a right to request access to the personal information we hold about you by making a Subject Access Request
• if you believe any of your personal information is inaccurate or incomplete, you have a right to request we correct or complete your personal information
• you have a right to request we restrict the processing of your personal information for specific purposes, and
• if you wish us to delete your personal information, you may request that we do so.

Any requests received by Wheatley Group will be considered under applicable UK Data Protection Legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office at www.ico.org.uk

The accuracy of our information is important to us - please help us keep our records updated by informing us of any changes to your personal information.

Our Privacy Notice is regularly kept up to date and this version was updated on 1 April 2020. The latest full version is always available from our website.