Introduction

This policy was updated to reflect the introduction of General data Protection Regulations (GDPR) on 25th May 2018.

Denville Hall collects personal information which helps us care for our employees, volunteers, residents, their families and loved ones. We use your data in line with date protection law, including GDPR and the data protection Act 2018 (DPA). Personal information is any information that identifies us as a living individual. This privacy policy explains what information we intend to use, the legal reasons for using this information and your rights under the law. Denville Hall is dedicated to making sure that personal information is used according to the law, and confidential information held by us is safe.

If you have any concerns or questions how your information is being used, please contact the General Manager at Denville Hall.

You also have the right to contact the Information Commissioner’s Office (ICO) if you have a complaint about the way your information is being used.

The ICO can be contacted at:

Email: casework@ico.org.uk Telephone: 03031231113 Information Commissioner’s Office Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

Residents

What information is collected and how is it used?

We use your personal information so that we can provide care services to you, we only collect enough information to allow us to provide you with the best possible care. We do this to fulfil our contract of care to you.

The information we collect from you which includes:

• Information that identifies you, basic details such as name, gender, address & contact details
• Medical & health information, including notes, images and reports about your health and any treatment/ care you have received or will need in the future.
• Financial information including bank details & billing details
• Details of contact that we have had with you to ensure we can provide the care you require
• Information and your religious beliefs
• Information about your language
• Information about your ethnicity
• Your image including photographs

We may also collect information about you from other people and organisations, such as:

• Medical & health information, from health & social care organisations, including medical notes and reports about your health and any treatment and care you have received or may may require
• Social care and safeguarding reports, assessments and referrals

Sharing your information

 We share your personal information under certain circumstances. When we do share information, we use as little as possible and on a strictly need to know basis.

• If you require regular or emergency medical treatment, we will share your personal information to enable healthcare providers such as hospitals, and GPs to care for
• We will share information about you with friends and family, where you have indicated that you are happy for that information to be shared.
• If you are funded by the local authority, we will share your information with
• We share information with our legal representatives and Clinical Commissioning Group if we need to reclaim money owed to us to pay for your care

How we use the information we collect

We use your information to give you the best care possible. This includes:

• Using your identity to be able to know who you are, this helps us ensure that you receive the right care
• Healthcare information, which helps us make sure that you receive the right care, such as medication, as well as getting you to your Hospital appointments and receiving the care and support offered by the
• Using financial information to make sure we are paid for the care that you receive
• Understanding your beliefs, to help us ensure you receive the spiritual care you wish to have.
• Using information to protect you from individuakls who may wish to harm myou
• Understanding your communication information helps us communicate effectively with you
• Handling concerns and complaints about the care we provide
• Investigating incidents
• Sharing your image to identify you
• Sharing your photograph in marketing materials, where you have provided consent.

How long we keep your information for

Denville Hall keeps your personal information during your stay with us so that we can care for you, we also retain the information when you leave our care, for 8 years after we last provided care to you.

We keep your information in-case our records are requested by a future care provider, to audit the quality of care we can provide our residents and to defend ourselves against legal claims.

How we comply with the law

There are several reasons that Denville Hall can legally use your information:

• You, an appointed person, or a local authority has signed a contract with us to care for you. The information entrusted to us helps us to fulfil that contract and take the best care of Without this information Denville Hall cannot care for you
• We use information about your religious & philosophical beliefs to provide you with the best These beliefs impact the way in which individuals wish to be treated, treatment they may not wish to receive and end of life care
• We rely on your consent for using your image for marketing purposes

All organisations must have a legal condition for processing personal information. Some personal information contains sensitive information, this is called special category data. If organisations use special category information they must have a second legal condition.

The first legal condition is usually a piece of EU legislation called the general Data Protection Regulation 2016 (GDPR).

The second legal condition may also be from GDPR, but may be from Data Protection Act 2018 (DPA), in cases where the GDPR delegates legislative power to EU member staes. When the UK leaves the EU, the GDPR will be incorporated into Uk law through the EU Withdrawal Bill.

These conditions are set out in the table below, along with specific retention periods:

Information used	Legal condition for using information	Legislative references	Second legal condition for using information (where required)	Legislative references	Retention period
Identity (name, DOB, contact details), photograph	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	8 years after discharge or last use of record
Medical & Healthcare information	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	Processing is necessary for health or social care purposes	GDPR Article 9(2)(h) DPA Schedule1, s.2	8 years after discharge or last use of record
Financial information	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	6 years after the end of the financial year the record corresponds to
Details of information such as quotes & referrals	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	6 months after enquiry received
Religious & philosophical beliefs	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	Processing is necessary for health or social care purposes	GDPR Article 9(2)(h) DPA Schedule1, s.2	8 years after discharge or last use of record
Residency or immigration status	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	Processing is necessary for reasons of substantial public interest Processing is necessary for the maintenance of effective immigration controls and the investigation or detection of activities that would undermine the maintenance of effective immigration control	GDPR Article 9(2)(g) DPA schedule 2,s.4(a)(b)	8 years after discharge or last use of record
Criminal activity	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	Processing is necessary for preventing & detecting unlawful acts, for protecting the public against dishonesty and for complying with regulatory agencies in investigating unlawful acts & dishonesty	GDPR Article 10 DPA schedule 1, s.10,11,12	8 years after discharge or last use of record
Language	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	8 years after discharge or last use of record
Ethnicity	Legitimate interest	GDPR article 6(1)(f)	Processing is necessary for reasons of substantial public interest Processing is necessary for identifying & reviewing existence of quality treatment between groups of people	GDPR Article 9(2)(g) DPA Schedule1, s.8	8 years after discharge or last use of record
Information from customer surveys	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)			2 years after feedback has been received

 

For Employees & Contractors (Including Applicants)

What information we collect and use

We use your personal information to fulfil our obligations to you as an employer, to ensure you are paid for your work and that you are protected in the work place. We do this because you have entered into a contract with Denville Hall.

We collect information from you, as well as creating information once you have been successful in a job application, this includes:

• Information that identifies you, basic details such as name gender, date of birth, address, telephone number, email address and other contact details
• Information that tells us your ethnicity, age & race
• Information that Denville Hall creates that identifies you, such as employee reference, pay rates, payroll number and job role.
• Financial information including bank account, pension details & national insurance number
• Any professional registration status or qualifications, such as nursing registration and validation
• Information declaring unspent criminal convictions
• Information relating to leave, including annual leave, maternity, paternity, adoption and shared parental leave
• Medical & health information, including sick leave, allergies or occupational health requirements
• Images and photographs.

We also collect personal information about you from other people and organisations, such as:

• Criminal record check conducted by the Disclosure & Barring Service (DBS)
• We request confidential references from referees that you have given to us, which contain information about you
• Receive from HMRC such as tax codes
• Our finance team receive information from the courts if you have been issued with an attachment of earnings order (AEO) by the courts.

Do we share your information?

We share your personal information under certain circumstances. When we do share your information, we use as little as possible and on a need to know basis.

• If you require emergency medical treatment we will share your personal information with health professionals to ensure you receive the appropriate treatment
• We share your information with HMRC to ensure you are taxed correctly
• If you have asked us to we will share your information with our pension providers
• If you have asked us to we will share personal details, including details of your earnings, length of service, employment status etc. with appropriate organisations for personal applications such as mortgages or rental agreements
• If you are a member of a regulatory body such as NMC, we will share your information with them to ensure that you are registered, monitor your need to revalidate and report mis-conduct
• If you have consented, we will share your photograph in marketing materials.

How we use the information that we collect

We use your personal information to fulfil our obligations to you as an employer, to ensure you are paid for your work and that you are protected in the work place. This includes:

• Using financial information to make sure you are paid and taxed correctly
• Ensuring that you are a registered professional where that is a requirement for your role
• Using your information to manage your performance in fulfilling your contract with us
• Understanding how we can support you if you have a disability or impairment
• Ensuring you are employed in a suitable environment
• Assessing if you present any risk to other individuals
• Understanding the diversity of our workforce and complying with equality and diversity legislation
• Ensuring you receive adequate training for your role
• Using your information to keep our residents and employees safe from dishonesty and harm
• Using your image for sharing news about the care we provide for marketing purposes, if you have consented
• If you have been issued with an attachment of earnings order (AEO), we will make the relevant deductions from your
• Handling concerns and complaints about the care we provide
• Investigating incidents

How long do we keep your Information?

Denville Hall keeps your personal information during your employment, we also retain your information when you leave Denville Hall for six years after the last date you worked for us.

How do we comply with the law?

We can legally use your information for several reasons:

• You have signed a contract of employment with us and we use that information to fulfil that contract
• We can share your information with health care professionals in emergency situations where your life maybe at risk
• We can use healthcare information for occupational medical care and to assess your working capacity
• We have a legitimate interest to monitor and review the diversity of our workforce to help us promote equality and diversity at Denville Hall and use your information to do this
• We can use and share your information to prevent and detect crime, assist law enforcement agencies to protect other individuals from dishonesty

All organisations must have a legal condition for processing personal information. Some personal information contains sensitive information, this is called special category data. If organisations use special category information they must have a second legal condition.

The first legal condition is usually a piece of EU legislation called the general Data Protection Regulation 2016 (GDPR).

The second legal condition may also be from GDPR, but may be from Data Protection Act 2018 (DPA), in cases where the GDPR delegates legislative power to EU member stages.

When the UK leaves the EU, the GDPR will be incorporated into Uk law through the EU Withdrawal Bill. These conditions are set out in the table below, along with specific retention periods:

 

For Volunteers (Including Work Experience & Donors)

What information do we collect and use?

We use your personal information to fulfil our obligations to you as volunteers and to maintain the privacy & confidentiality of our residents and employees. We do this because you have entered into a volunteer agreement with Denville Hall.

We collect information from you which includes:

• Information that identifies you, basic details such as name, address, telephone number, email address and other contact details
• Financial information including bank account
• Information declaring unspent convictions
• We will publish your image if you are happy for us to do so

 

We will also collect information about you from other people and organisations, such as:

• Criminal record check conducted by Disclosure & Barring service
• We request confidential references from referees that you have given us, which contain information about you

Sharing your information

 We share your personal information under certain circumstances. When we do share information, we use as little as possible and on a need to know basis:

• If you require emergency medical treatment we will share your personal information with health professionals to ensure you receive appropriate treatment
• We will publish your image, if you are happy for us to do so

How we use the information that we collect

 We use your personal information so that we can make sure we protect you in your place of volunteering and to make the most of the volunteering partnership. This includes:

• Understanding how we can support you if you have a disability or impairment
• Ensuring we offer you volunteering in an area that is suitable for you
• Understanding the diversity of our volunteers
• Using your information to keep our residents and employees safe from dishonesty and harm
• We will publish your image if you are happy for us to do so
• Handling concerns and complaints about the care we provide
• Investigating incidents

How long do we keep your information for?

 Denville Hall keeps your personal information during the time you volunteer with us and for 3 years following the last date that you volunteered at Denville Hall.

How do we comply with the law?

We can legally use your information for several reasons:

• You have consented for us to use your information
• We can share your information with health care professionals in emergency situations where your life maybe at risk
• We have a legitimate interest to monitor and review the diversity of our workforce to help us promote equality and diversity at Denville Hall and use your information to do this
• We have a legitimate interest in knowing any information that helps to prevent and detect crime. We can use and share your information to prevent and detect crime, assist law enforcement agencies to protect other individuals from dishonesty

All organisations must have a legal condition for processing personal information. Some personal information contains sensitive information, this is called special category data. If organisations use special category information they must have a second legal condition.

The first legal condition is usually a piece of EU legislation called the general Data Protection Regulation 2016 (GDPR).

The second legal condition may also be from GDPR, but may be from Data Protection Act 2018 (DPA), in cases where the GDPR delegates legislative power to EU member stages. When the UK leaves the EU, the GDPR will be incorporated into Uk law through the EU Withdrawal Bill.

These conditions are set out in the table below, along with specific retention periods:

Information used	Legal condition for using information	Legislative references	Second legal condition for using information (where required)	Legislative references	Retention period
Identity (name, contact details), photograph	Consent	GDPR article 6(1)(a)	N/A	N/A	3 years after the volunteer leaves
Medical & Healthcare information including sick leave	Consent	GDPR article 6(1)(a)	Consent	GDPR Article 9(2)(b) DPA Schedule1, s.2(a)(b)	3 years after the volunteer leaves
Medical & Healthcare information	Processing is necessary to protect the information subject’s vital interests	GDPR article 6(1)(d)	Processing is necessary to protect the data subject’s vital interests	GDPR Article 9(2)(h)	3 years after the volunteer leaves
Criminal activity	Legitimate Interest	GDPR article 6(1)(f)	Processing is necessary for preventing & detecting unlawful acts, for protecting the public against dishonesty and for complying with regulatory agencies in investigating unlawful acts & dishonesty	GDPR Article 10 DPA schedule 1, s.10,11,12	3 years after volunteer leaves
Ethnicity, racial and language information	Consent	GDPR article 6(1)(a)	Processing is necessary for reasons of substantial public interest Processing is necessary for identifying & reviewing existence of quality treatment between groups of people	GDPR Article 9(2)(g) DPA Schedule1, s.2, 8	3 years after volunteer leaves

 

Guardians, Relatives and Friends

What information we collect and use

We use your personal information so that we can understand if there are legal guardians, relatives and friends, who they are and who to contact in an emergency situation, and our residents’ visitor preferences.

We collect information from you, we also collect information from our residents or employees, this includes:

• Information that identifies you, basic details sucha s name, address telephone number, email address and other contact details
• Information about legal guardianship of a resident

Sharing your information

We share your personal information under certain circumstances. When we do share your personal information, we use as little as possible and strictly on a need to know basis.

• If you require emergency medical treatment we will share your personal with health professional to ensure you receive appropriate treatment
• We will publish your image, if you are happy for us to do so.

How we use the information we collect

We use your personal information to fulfil our obligations to our residents. This includes:

• Using your information to keep our residents and employees safe from dishonesty and harm
• Enursing that the relatives of residents and employees are contacted in an emergency situation or if there are changes in the health of a resident
• Keeping a record of any individuals who are permitted access to the confidential health information about our residents

How long we keep your information

Denville Hall keeps your personal information with-in the care record of the resident it relates to. We keep your information for 6 years from your last contact with us. If you require emergency medical treatment, we will keep this information for 6 years after the last recorded event.

We keep your information to audit the quality of care that we provide to our residents and to defend ourselves against legal claims. In all cases we will only hold onto the minimum information that we require for our legal and regulatory requirements.

How we comply with the law

We can legally use your information for several reasons:

• We have a legitimate interest in protecting the privacy of our residents and protecting them from dishonesty and harm.
• We can share your information with healthcare professionals in emergency situations where your live is at

All organisations must have a legal condition for processing personal information. Some personal information contains sensitive information, this is called special category data. If organisations use special category information they must have a second legal condition.

The first legal condition is usually a piece of EU legislation called the general Data Protection Regulation 2016 (GDPR).

The second legal condition may also be from GDPR, but may be from Data Protection Act 2018 (DPA), in cases where the GDPR delegates legislative power to EU member stages. When the UK leaves the EU, the GDPR will be incorporated into Uk law through the EU Withdrawal Bill.

These conditions are set out in the table below, along with specific retention periods:

Information used	Legal condition for using information	Legislative references	Second legal condition for using information (where required)	Legislative references	Retention period
Identity (name, DOB, contact details), photograph	Processing is necessary inorder to take steps to ente rinto a contract and for the performance of a contract	GDPR article6(1)(b)	N/A	N/A	6 years after the employee leaves 6 months after an unsuccessful application
Medical & Healthcareinformation including sick leave	Processing is necessary for the performance of a contract	GDPR article6(1)(b)(d)	Processing is necessary for health or social care purposes, in particular the purposes of occupational and preventative medicine and the assessment of an employee’s working capacity	GDPR Article9(2)(c) DPA Schedule1,s.2(a)(b)	6 years after the employee leaves
Medical & Healthcareinformation	Processing is necessary to protect the data subject’s vital interests	GDPR article6(1)(d)	Processing is necessary to protect the data subject’s vital interests	GDPR Article9(2)(h)	6 years after the employee leaves
Financial information	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	6 years after the close of each financial year
Qualifications, work history, professional registrations	Processing is necessary in order to take steps to enter into a contract and for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	6 years after employee leaves
Residency or immigration status	Processing is necessary in order to take steps to enter into a contract and for the performance of a contract	GDPR article 6(1)(b) Immigration Act 2006	Processing is necessary for reasons of substantial public interest Processing is necessary for the maintenance of effective immigration controls and the investigation or detection of activities that would undermine the maintenance of effective immigration control	GDPR Article 9(2)(g) DPA schedule 2,s.4(a)(b)	6 years after employee leaves
Criminal activity	Processing is necessary in order to take steps to enter into a contract and for the performance of a contract	GDPR article 6(1)(b)	Processing is necessary for preventing & detecting unlawful acts, for protecting the public against dishonesty and for complying with regulatory agencies in investigating unlawful acts & dishonesty	GDPR Article 10 DPA schedule 1, s.10,11,12	6 years after employee leaves
Ethnicity, racial and language information		GDPR article 6(1)(f)	Processing is necessary for reasons of substantial public interest Processing is necessary for identifying & reviewing existence of quality treatment between groups of people	GDPR Article 9(2)(g) DPA Schedule1, s.8	8 years after discharge or last use of record
Photograph	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	6 years after employee leaves
Annual, maternity, paternity & shared parental leave	Processing is necessary for the performance of a contract	GDPR article 6(1)(b)	N/A	N/A	6 years after employee leaves

 

Information used	Legal condition for using information	Legislative references	Second legal condition for using information (where required)	Legislative references	Retention period
Identity (name,contactdetails),	Processing is necessary for the purposes of the legitimate interests persued by the controller or by a third party	GDPR article6(1)(f)	N/A	N/A	6 years
Medical &Healthcareinformation	Processing is necessary in order to protect the vital interests of the data subject	GDPR article6(1)(d)	Processing is necessary in order to protect the vital interests of the data subject	GDPR Article9(2)(h)	6 years from when the last record is used

 

For suppliers

We use your personal information as part of procurement of services and supplies. We collect information from all suppliers we use, which includes:

• Information that identifies you, basic details such as name, address, telephone number, email address and other contact details
• For sole traders we collect financial information including bank account information which identifies you as an individual

Sharing your information

We will share financial information with our bank.

How we use your information

We use your information to pay you for your services.

How long do we keep your information?

Denville Hall keeps your personal information for 6 years following the end of the contract or services delivered. We keep your information to monitor the performance of contracts and to defend ourselves against legal claims.

All organisations must have a legal condition for processing personal information. Some personal information contains sensitive information, this is called special category data. If organisations use special category information they must have a second legal condition.

The first legal condition is usually a piece of EU legislation called the general Data Protection Regulation 2016 (GDPR).

The second legal condition may also be from GDPR, but may be from Data Protection Act 2018 (DPA), in cases where the GDPR delegates legislative power to EU member stages. When the UK leaves the EU, the GDPR will be incorporated into Uk law through the EU Withdrawal Bill.

These conditions are set out in the table below, along with specific retention periods:

Information used	Legal condition for using information	Legislative references	Second legal condition for using information (where required)	Legislative references	Retention period
Identity (name,contact details),	Processing is necessary in order to take steps to ente rinto a contract and the performance of a contract	GDPR article 6 (1)(b)	N/A	N/A	6 years after the contract period is completed or services/goods have been delivered

 

For Enquiries & Complaints

What information we collect and use

You may contact Denville Hall seeking information about the care that is available. You may also contact us as a member of the public with a complaint regarding Denville Hall’s conduct or the conduct of an employee.

We collect information from you which includes:

• Information that identifies you, basic details such as name address, telephone number, email address
• Information about your complaint

Sharing your information

We do not intend to share any of your personal information.

How long we keep your information for

We keep information relating to enquiries for 1 year after the enquiry is made. We keep information relating to complaints for 6 years following the closure of the complaint. We keep your information for enquiries to maintain audit statistics and in the case of complaints to defend ourselves against legal claims.

All organisations must have a legal condition for processing personal information. Some personal information contains sensitive information, this is called special category data. If organisations use special category information they must have a second legal condition.

The first legal condition is usually a piece of EU legislation called the general Data Protection Regulation 2016 (GDPR).

The second legal condition may also be from GDPR, but may be from Data Protection Act 2018 (DPA), in cases where the GDPR delegates legislative power to EU member stages. When the UK leaves the EU, the GDPR will be incorporated into Uk law through the EU Withdrawal Bill.

These conditions are set out in the table below, along with specific retention periods:

 

Information used	Legal condition for using information	Legislative references	Second legal condition for using information (where required)	Legislative references	Retention period
Identity (name,contact details) for enquiries	Processing is necessary in order to take steps to enter into a contract	GDPR article6(1)(b)	N/A	N/A	1 year following receipt of an enquiry
Identity (name, contact details) for complaints	Legitimate interest	GDPR article 6(1)(f)	N/A	N/A	6 years following closure of the complaint

 

Legal & Regulatory Obligations

We may receive requests for information from courts, law enforcement agencies, regulatory agencies and othe public & government authorities, which may include authorities outside of your country of residence. When we receive these requests we will inform you as soon as possible. There are circumstances in which we cannot inform you that information is used or shared because it may prejudice the work of law enforcement agencies and other organisations.

We may be required to use and keep personal information for legal reasons, such as the prevention, detection or investigation of crime or fraud. We may also use personal information to meet our internal and external requirements and for security purposes.

Security

We are committed to keep your personal information secure. We have put into place physical, electronic and operational procedures intended to safeguard an dsecure the information we collect. All employees at Denville Hall have a legal duty to respect the confidentiality of your information and access to your confidential information is restricted to those who have a reasonable need to access.

We do not hold any information outside the EU.

Your Rights

Under the General Data Protection Regulation, individuals (data subjects) have a number of rights which are detailed below. Some of these only apply in specific circumstances and are qualified in several respects by exemptions in information protection legislation. We will advise you in our response to your request if we are relying on any such exemptions.

Access to personal information

You have a right to request a copy of the personal information that we hold about you. Should you wish to make a request , you can contact the General Manager at Denville Hall, Wilma Thomson. You should include adequate information to identify yourself and such other relevant information that will reasonably assist us in fulfilling your request. We will deal with your request with in one month for your dated request.

Right to Rectification (correction)

You can request us to rectify and correct any personal information that we are processing about you which is incorrect.

Right to withdraw consent

Where we have relied upon your consent to process personal information, you have the right to withdraw this consent.

Right of erasure

You can request us to erase your personal information under certain circumstances. This right only applies in certain circumstances, this is not a guaranteed or absolute right.

Right to data portability

This right allows you to obtain your personal information in an electronic format, where you have provided information to us with your consent, or where the information was necessary for us to provide you with our services or employment. You can request that the information be given in a format which enables you to transfer that personal information to another organisation. You may have the right to have your personal information transferred by us directly to another organisation, if this is technically feasible.

Right to restrict processing of personal information

You have the right in certain circumstances to request that we suspend our processing of any or all your personal information. Where we suspend our proceeding of your personal information we will still be permitted to store your personal information, but any other processing of this information will require your consent, subject to certain exemptions.

This could restrict the ability of Denville Hall to care for our residents and pay employees.

Right to object to processing of personal information

You have the right to object to our use of personal information which is used where we feel that we have legitimate interest. However we may continue to process your personal information, despite your objection, where there are legitimate grounds to do so or we need to process your personal information in connection with any legal claims.

Rights relating to automated decision making and profiling

 You have the right not to be subject to a decision which is based solely on automated processing (without human involvement) where that decision produces a legal effect or otherwise significantly affects you. This right means that you can request that we involve one of our employees or representatives in the decision making proces