ELIZABETH FINN HOMES LIMITED – PRIVACY NOTICE
1. Who We Are
1.1. This privacy notice (the “Privacy Notice”) applies to all personal information processing activities carried out by Elizabeth Finn Home Limited (‘EFHL’)
1.2. This privacy notice applies to all individuals (including residents, staff and contractors) with whom we have a relationship.
1.3. EFHL is a data controller in respect of personal information that we process in connection with our business.
1.4. In this notice, references to “we”, “us” or “our” are references to EFHL.
1.5. In this notice references to ‘you’ may also refer to your legally appointed representative where one is in place.
1.6. Our principal address is Hythe House, 200 Shepherds Bush Road, London, W6 7NL and our contact details can be located at www.efhl.co.uk
1.7. We are a wholly owned subsidiary of the charity Turn2Us. More information about Turn2Us can be found at www.turn2us.org.uk.
1.8. We respect individuals’ rights to privacy and to the protection of personal information. The purpose of this Privacy Notice is to explain how we collect and use personal information in connection with our business.
1.9. “Personal information” means information about a living individual who can be identified from that information (either by itself or when it is combined with other information).
1.10. We may update our Privacy Notice from time to time. When we do we will publish the updated Privacy Notice on our website. We would encourage you to visit our website regularly to stay informed of the purposes for which we process your information and your rights to control how we process it.
2. The Information We Process
2.1. We collect and process various categories of personal information at the start of, and for the duration of, your relationship with us.
2.2. We will limit the collection and processing of information to information necessary to achieve one or more legitimate purposes as identified in this notice.
2.3. Personal information may include:
2.3.1. basic personal information, including name and address, date of birth and contact details;
2.3.2. information about your family (such as dependents, marital status, next of kin and contact details);
2.3.3. financial information for tax, payroll and pension purposes
2.3.4. information about your financial circumstances, including, assets and proof of income;
2.3.5. visual images and personal appearance (such as copies of passports, photographs for care documentation)
2.4. We may also process certain special categories of information for specific and limited purposes.
2.5. We will only process special categories of information where we’ve obtained your explicit consent or are otherwise lawfully permitted to do so (and then only for the particular purposes and activities set out at Appendix A for which the information is provided). This may include:
2.5.1. information about racial or ethnic origin,
2.5.2. religious or philosophical belief
2.5.3. physical or psychological health details or medical conditions;
3. How We Obtain Information
3.1. Your information is made up of all the personal information we collect and hold about you.
3.2. It includes:
3.2.1. information you give to us;
3.2.2. information that we receive from third parties (such as a GP or previous employer);
3.2.3. information that we learn about you through our relationship with you;
4. Your Rights
4.1. We want to make sure you are aware of your rights in relation to the personal information we process about you. We have described those rights and the circumstances in which they apply in the table below.
4.2. If you wish to exercise any of these rights, if you have any queries about how we use your personal information that are not answered here, or if you wish to complain to our Data Protection Officer please contact us immediately as detailed in this notice.
4.3. Please note that in some cases, if you do not agree to the way we process your information, it may not be possible for us to provide services or employment to you.
Table of Your Rights
You have the right to be informed about the collection and use of your personal data.
This privacy notice is a key part of how we keep you informed about the collection and use of your personal data. If you have any queries about the content of this notice or how we manage your information please contact us at: EFHL, Subject Access Requests, Hythe House, 200 Shepherds Bush Road, London W6 7NL. 0208 834 9200.
You have a right to get access to the personal information we hold about you.
If you would like a copy of the personal information we hold about you, please contact us as above.
You have a right to rectification of inaccurate personal information and to update incomplete personal information.
If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information.
You have a right to request that we delete your personal information.
You may request that we delete your personal information if you believe that:
- we no longer need to process your information for the purposes for which it was provided;
- we have requested your permission to process your personal information and you wish to withdraw your consent; or
- we are not using your information in a lawful manner.
You have a right to request us to restrict the processing of your personal information.
You may request us to restrict processing your personal information if you believe that:
- any of the information that we hold about you is inaccurate;
- we no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims; or
- we are not using your information in a lawful manner.
You have a right to data portability.
Where we have requested your permission to process your personal information or you have provided us with information for the purposes of entering into a contract with us, you have a right to receive the personal information you provided to us in a portable format.
You may also request us to provide it directly to a third party, if technically feasible. We’re not responsible for any such third party’s use of your information, which will be governed by their agreement with you and any privacy statement they provide to you.
If you would like to request the personal information you provided to us in a portable format, please write to or contact us at: EFHL, Subject Access Requests, Hythe House, 200 Shepherds Bush Road, London W6 7NL. Email: HRAdmin@efhl.co.uk
Or contact us at 0208 834 9200
You have a right to object to the processing of your personal information.
You have a right to object to us processing your personal information unless we can demonstrate compelling and legitimate grounds for the processing, which may override your own interests or where we need to process your information to investigate and protect us or others from legal claims.
Depending on the circumstances, we may need to restrict or cease processing your personal information altogether, or, where requested, delete your information. Please note that if you object to us processing your information, we may have to suspend or cease any services we provide to you.
In addition to the rights detailed above you also have the right to Raise a Complaint on how we have handled your personal information. If you wish to make a complaint please contact our Data Protection Officer who will investigate the matter. We hope that we can address any concerns you may have, but you can always contact the Information Commissioner’s Office (ICO). For more information visit www.ico.org.uk
5.1. We have outlined below in Annex 1 the lawful basis on which we operate. This does not for the most part, require us to seek explicit consent to collect process and store your personal information.
5.2. Where we do require specific consent to collect, process and store your personal information, we will request this from you directly on every occasion that this is required.
5.3. You can withdraw your consent for us to request, process and store your personal information at any time. If you wish to do this please contact our Data Protection Officer.
6. Changes To The Way We Use Your Information
6.1. From time to time we may change the way we use your information. Where we believe you may not reasonably expect such a change we will notify you and will allow a period of at least 30 days for you to raise any objections before the change is made. However, please note that in some cases, if you do not agree to such changes it may not be possible for us to continue to provide certain services or employment to you.
7. How We Use And Share Your Information With Third Parties
7.1. We will not share your information with anyone outside EFHL except:
7.2. where we have your permission;
7.3. where it is necessary to provided our service to you;
7.4. where we are required by law and by law enforcement agencies, judicial bodies, government entities, tax authorities or regulatory bodies;
7.5. with third-party guarantors or other companies that provide you with benefits or services (such as insurance cover) associated with your service or contract;
7.6. where required for a proposed sale, reorganisation, transfer, financial arrangement, asset disposal or other transaction relating to our business and/or assets held by our business;
7.7. in anonymised form as part of statistics or other aggregated data shared with third parties; or
7.8. where permitted by law, it is necessary for our legitimate interests or those of a third party, and it is not inconsistent with the purposes listed above.
8. Transferring Information Overseas
8.1. We may transfer your information to organisations in other countries on the basis that anyone to whom we pass it protects it in the same way we would and in accordance with applicable laws.
8.2. In the event that we transfer information to countries outside of the European Economic Area (which includes countries in the European Union as well as Iceland, Liechtenstein and Norway), we will only do so where;
8.3. the European Commission has decided that the country or the organisation we are sharing your information with will protect your information adequately; and/o
8.4. the transfer has been authorised by the relevant data protection authority.
9. How Long We Keep Your Information
9.1. By providing you with services or contracts, we create records that contain your information, such as personal details, care records, employment details etc. Records can be held on a variety of media (physical or electronic) and formats.
9.2. We manage our records to help us to provide our services and to comply with legal and regulatory requirements. Records help us demonstrate that we are meeting our responsibilities and to keep as evidence of our business activities.
9.3. Retention periods for records are determined based on the type of record, the nature of the activity, product or service, and the applicable legal or regulatory requirements. Information on retention periods for all our records is available from the Data Protection Officer upon request. Contact 0208 834 9200
9.4. We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies or our regulators. This is intended to make sure that we will be able to produce records as evidence, if they are needed.
10.1. We are committed to ensuring that your information is secure with us and any third parties who act on our behalf and will only use information collected lawfully in accordance with;
- GDPR and Data Protection Act 2018
- Health and Social Care Act 2012
- Human Rights Act 1998
- NHS Codes of Confidentiality, Information Security and Records Management
- Caldicott Principles
Appendix 1 – Legal Basis for Processing Your Data
We process your data because;
- You have given us consent to do so;
- We are required to do so in order to fulfil a contract that we have with you;
- We have a legal obligation to do so under the Health and Social Care legislation;
- We have a legitimate business interest.
We process your special category data because;
- It is necessary due to social security, safeguarding and social protection requirements;
- It is necessary for us to provide and manage our services;
- We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.
We may also process your certain data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent.