Question 1

1. Who we are and contact details

Accepted Answer

MHA is the data controller for the personal data we process. MHA is a registered charity in England and Wales (No. 1083995) and Scotland (No. SC040155) and a company limited by guarantee (No. 4043124). Our registered office is: MHA, Epworth House, Stuart Street, Derby, DE1 2EQ.

If you have any questions about this privacy notice, or wish to exercise your rights, please contact MHA’s data protection officer using the contact details below.

Email: DataProtectionOfficer@mha.org.uk
Phone: 01332 221893
Post: Data Protection Officer, MHA, Epworth House, Stuart Street, Derby, DE1 2EQ

Question 2

2. MHA colleagues: processing of personal information

Accepted Answer

‘Colleagues’ include: applicants, employees, volunteers, contractors, board members

This privacy notice provides information about: the personal information that MHA collects about you as colleagues (including applicants); the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

2.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

2.1.1. Processing for staff recruitment, administration and management

We collect or use the following personal information for staff recruitment, administration and management:

Name (P)
Home address (P)
Phone numbers (P)
Email address and emails (P)
Date of Birth (P)
National Insurance number (P)
Marital Status (P)
Professional registration (P)
Driving License (P)
Health Information (S) incl. vaccination status
Next of kin or emergency contact (P)
Proof of Right to Work (P) e.g. passport, proof of address
Employment history (P) e.g. job application, employment references or secondary employment
Education history (P)
Criminal convictions or cautions(S) (incl. DBS checks)
Performance records (P) e.g. 1:1s, appraisals, disciplinary records
Training history (P)
IT use & device location tracking (P)
Photos (P) e.g. notice boards, badges & when you clock in.
CCTV recordings (P)
Phone call recording (P)
Disabilities (S)
Racial or ethnic origin (S)
Religious or philosophical beliefs (S)
Trade union membership (S)
Sex, gender & sexual orientation (S).

The lawful bases for processing your personal information for staff recruitment, administration and management are:

Contract: MHA will process your personal information to fulfil the contract (incl. volunteering agreement) or to take steps to enter into a contract. This may include special category information to make special adjustments.
Legal obligations: MHA has a legal obligation to process your personal data regarding your: ‘right to work’, salary, national insurance and PAYE tax and regarding your pension.
Legitimate interest: It is in MHA’s legitimate interest to process your personal information for the following:
- Job application: applications through an employment portal may use automatic processing. More information available on request.
- Work deliveries to you home address, if you work from home.
- To create an account on MHA’s Workplace by Meta, to aid internal communication and collaboration.
- Mystery Shoppers. MHA uses ‘mystery shoppers’ to call its services to gather information about how calls and enquiries are handled. Calls may be recorded and use to improve our services.
- To contact you for your views. MHA is continuously seeking to improve. To this end we may occasionally ask you to: complete a survey, take part in a discussion group, or give us your views in another way.
- MHA Cares for You. To offer employment benefits.
- You location may be tracked if you have an MHA provided mobile phone, laptop or tablet. This is so we can locate lost or stolen devices, not for staff monitoring.
- CCTV is captured to keep you, other individuals and property safe and will only be used in relation to criminal investigations.

2.1.2. Processing for salaries and pensions

We collect or use the following personal information for managing salaries and pensions:

Job role and employment contract (P)
Time spent working (P) (e.g. timesheets or clocking in and out)
Expenses claims (P)
Maternity, paternity, shared parental and adoption leave and pay (P)
Absence records (S)
Bank account details (P)
Payroll records (P)
Tax status (P)

Our lawful bases for collecting or using personal information for managing salaries and pensions are:

Contract
Legal obligation.

2.1.3. Processing for managing staff health and wellbeing

We collect or use the following personal information for managing staff health and wellbeing:

General health and wellbeing information (S)
Occupational health referrals and reports (S)
Sick leave forms or fit notes, from a GP or hospital (S)
Accident at work records (S)
Access needs or reasonable adjustments (S)
Health information (S).

Our lawful bases for collecting or using personal information for managing staff health and wellbeing are:

Contract
Legal obligation
Vital interests.

2.2. Where we get your personal information from

We collect your information from the following places:

From staff members or volunteers
Employment agency
Referees (external or internal)
Occupational Health services
Trade Unions
Pension administrators or government departments
Staff benefit providers
Mystery shoppers
CCTV systems.

2.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention period
Application Records (CV, application form, etc) including vaccination status, e.g. seasonal flu and covid	1 year for unsuccessful applicants, but may be retained longer with consent, for future vacancies 6 years after leaving for successful applicants
Terms and conditions, agreements	6 years after leaving
Personal File: 1:1’s, Appraisals, disciplinary records, absence records, pay & benefits information, training records	6 years after leaving
Telephone call recordings	6 months
CCTV recordings	30 days
Access to Vivup and information shared with Vivup	During your employment if you have registered for the service
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

2.4. Who we share your information with

In some circumstances, we may share information with the following organisations:

Training suppliers
HMRC
Employee benefit schemes
External and independent exit interview companies
Our regulators, including the Care Quality Commission (CQC) and the Care Inspectorate Wales (CIW)
MHA’s insurance company in relation to claims or possible claims
Organisations requesting an employment reference. MHA will only provide: ‘job title’, ‘start date’, ‘end date’ (if you have left). Additional information will only be provided with your consent. If the reference request is from a regulated care provider, we will also provide a ‘reason for leaving’ for colleagues in care homes and retirement living locations. This is to support MHA’s duty of candour to other health and social care providers, helping them meet their CQC requirements.

2.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Care Character carry out a values-based assessment, to determine suitability for a care role
Disclosure and Barring Service (DBS). MHA is required to carry out DBS checks for all colleagues working with vulnerable adults
Dynamic Business Services Limited provide out Learning Zone
Email List Verify is used to validate email addresses prior to bulk mailing.
Workplace from Meta (data in the USA protected by Controller to Processor Standard Contractual Clauses)
Zinc Work Limited for DBS checks and to check your ‘right to work’ in the UK
Mediahawk. Phone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services.
Information by Design An external and independent company who seek to obtain views from ex-colleagues relating to their experiences whilst working at MHA and provide feedback to aid continuous improvement.
Midland HR. Human Resource system & processing (data in the UK & the EU)
Radar Healthcare. The system used to records accidents and incidents.
Stor-a-File who store archived paper records.
The Pension Trust. MHA’s pension provider
Trusted Care Contact Centre. Phone calls (recordings and transcripts) and emails are processed on behalf of MHA and may be passed to MHA.
We Are Yoke Ltd carry out automated filtering of job applications, details available on request.

MHA and its data processors will not share the personal information provided for the contract:

With any other department within MHA unless it is necessary to achieve the purpose for which the data was provided
With any external parties except to meet the requirements of the contract.

Question 3

3. Residents and tenants: processing of personal information

Accepted Answer

This privacy notice provides information about: the personal information that MHA collects about residents and tenants; the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

3.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

3.1.1. Processing for enquiries and assessing a potential resident or tenant

We collect or use the following personal information for enquiries and assessing a potential resident or tenant:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Date of birth / age (P)
Health & wellbeing records (S)
Financial information (P)
CCTV recordings (P)
Phone call recording (P)
Live chat transcript (P).

The lawful bases for processing your personal information for enquiries and assessing a potential resident or tenant are:

Consent: your consent to share information when making an enquiry
Legitimate interest: it is in MHA’s legitimate interest to assess your needs before being admitted, to ensure MHA can meet your needs.

3.1.2. Processing for provision of retirement living and care services

We collect or use the following personal information for retirement living and care services:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Date of birth / age (P)
Health & wellbeing records (S)
Next of Kin or emergency contacts (P)
NHS & NI number (P)
Your likes and dislikes regarding your care requirements (P)
Resuscitation information (P)
Financial information (P)
Religion or religious beliefs (S)
Photos and videos (S)
Disabilities (S)
Racial or ethnic origin (S)
Religious or philosophical beliefs (S)
Sex, gender & sexual orientation (S)
CCTV recordings (P)
Information required by regulators (risk assessments, accident and incident records) (P).

Our lawful bases for collecting or using personal information for retirement living and care services are:

Contract: MHA has entered a contract for the provision of housing or care services.
Legitimate interest:
- Care being provided under a contract with the NHS or local authority. MHA has a legitimate interest to process the information in order to meet its contractual agreement with the NHS or a local authority.
- To contact you for your views. MHA is continuously seeking to improve. To this end we may occasionally ask you to: complete a survey, take part in a discussion group, or give us your views in another way.

3.1.3. Processing for building maintenance and utilities

We collect or use the following personal information for building maintenance and utilities:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P).

Our lawful bases for collecting or using personal information for building maintenance and utilities are:

Legitimate interest: we may share limited contact information of residents living in our retirement living schemes with building maintenance contractors and utility providers (e.g. gas and electricity providers as we need to ensure that our buildings are maintained and repaired and that utilities are provided.

3.2. Where we get your personal information from

We collect your information from the following places:

From staff resident or tenant
Family members
NHS
A local authority.

3.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention period
Waiting list for vacancy in service and general enquiries	6 months when requirements can’t be met 1 year for open enquiries, but extended with permission
Application forms and assessment information	6 months if the individual doesn’t move in 8 years after leaving MHA
Care records	8 years after leaving MHA
Finance records	7 years
Accident and incident records	10 years
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

3.4. Who we share your information with

In some circumstances, we may share information with the following organisations:

Other healthcare professionals including GPs, nurses, pharmacies and hospitals
Designated professionals (e.g. care home staff, social worker), including NHS teams, to support care and process funding requests
The organisation (LA or CCG) for whom we provide the service under a contract
People with Power of Attorney, Deputyship or people you have authorised access or when it is in your best interest
MHA’s insurance company in relation to claims or possible claims
Third-parties when there is a legal obligation to do so, including regulatory compliance
Building maintenance contractors to allow for repairs (Retirement Living Residents)
Utility providers to aid an easy transition into your new home (Retirement Living Residents). You will obviously be free to change your utility provider as and when you desire.

MHA may share your next of kin’s contact information with other care professionals.

MHA will not share your information with any third party for research purposes, including purposes for which the National Data Opt-Out would apply, unless you or your LPA (Health & Welfare) give explicit consent.

3.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Trusted Care Contact Centre: Some telephone calls and LiveChat processed on behalf of MHA. Calls may be recorded and the recordings passed to MHA and LiveChat transcripts may be passed to MHA.
Mediahawk: Telephone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services. MHA may share anonymised, limited details of your enquiry with Mediahawk to assist in assessing how effectively we handle requests.
Email List Verify: Used to validate email addresses prior to bulk mailing
Nourish Ltd: The provider of our care management system
Radar Healthcare: The system used to records accidents and incident
Civica UK Ltd, the provider of Keystone: System used for retirement living building management
Store-a-File: For storage of archived paper records.

MHA and its data processors will not share the personal information provided for the contract:

With any other department within MHA unless it is necessary to achieve the purpose for which the data was provided
With any external parties except to meet the requirements of the contract.

Question 4

4. MHA Communities members: processing of personal information

Accepted Answer

This privacy notice provides information about: the personal information that MHA collects about MHA Communities members; the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

4.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

4.1.1. Processing for enquires or becoming a member of MHA Communities

We collect or use the following personal information for enquires or becoming a member of MHA Communities:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Date of birth / age (P)
Marital Status (P)
Contacts (P): next of kin, family member, emergency contact
Health & wellbeing information (S)
Interests & hobbies (P)
Disabilities (S)
Racial or ethnic origin (S)
Religious or philosophical beliefs (S)
Sex, gender & sexual orientation (S)

The lawful bases for processing your personal information for becoming a member of MHA Communities are:

Consent: your consent to share information when going through the member application process.

4.1.2. Processing for provision of MHA Communities services

We collect or use the following personal information for provision of MHA Communities services:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Date of birth / age (P)
Marital Status (P)
Contacts (P): next of kin, family member, emergency contact
Health & wellbeing information (S)
Interests & hobbies (P)
Disabilities (S)
Racial or ethnic origin (S)
Religious or philosophical beliefs (S)
Sex, gender & sexual orientation (S)
Photos and videos (P)
CCTV recordings (P)
Information required by regulators (risk assessments, accident and incident records) (P)

Our lawful bases for collecting or using personal information for provision of MHA Communities services:

Consent: You give consent for your personal information to be processed to administer your membership, including:
- To development our services
- Contacts to only be contacted to ensure you are ok or in an emergency
- Medical information will only be used in an emergency and will only be provided to medical professionals. Copies may be taken on trips or holidays.
- Housing information will be used to assist with home visits.
Legitimate Interest: CCTV is captured to keep you, other individuals and property safe and will only be used in relation to criminal investigations

4.2. Where we get your personal information from

We collect your information from the following places:

You the member, potential member
A referring service
Family members.

4.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention period
Referrals	6 months
Membership form (members)	1 years after leaving the scheme
Membership form (for those who do not become members)	6 months after initial assessment
Health information for trips, events and holidays	Destroyed within 1 week of event
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

4.4. Who we share your information with

Your name and address may be shared with, a DBS (criminal records) checked befriender/volunteer to assist with home visits or transportation with your consent.

Individuals for whom you provide contact details (e.g. emergency contacts) may be informed that their details are being retained for emergency or general concern purposes, asking them to provide updates as appropriate.

Medical information may be shared with medical professionals for your vital interests.

The Scheme will not share other Personal Information provided for the membership:

With any other department within MHA
With any external parties without your consent.

MHA will not sell or swap your data with any third parties. We will not share your information with any third party for marketing purposes.

4.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

SugarCRM: The provider of our member management system
Radar Healthcare: The system used to records accidents and incident
Mediahawk: Phone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services. MHA may share anonymised, limited details of your enquiry with Mediahawk to assist in assessing how effectively we handle requests.
Email List Verify: Used to validate email addresses prior to bulk mailing.

MHA and its data processors will not share your personal information with any other department within MHA, unless it is necessary to achieve the purpose for which the data was provided.

MHA may transfer a minimal amount of your personal data to a data processor outside the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.

Question 5

5. Relatives and emergency contacts: processing of personal information

Accepted Answer

This privacy notice provides information about: the personal information that MHA collects about relatives and emergency contacts; the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

5.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

5.1.1. Processing for relatives making an enquiry about a service

We collect or use the following personal information for relatives making an enquiry about a service:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Telephone call recording (P)
Live chat transcript (P)
Views and opinions (P)
CCTV recordings (P).

The lawful bases for processing your personal information for relatives making an enquiry about a service are:

Consent you give consent at the time of the enquiry
Legitimate interest:
- Surveys: MHA is continuously seeking to improve. To this end we may ask you to complete a survey or give us your views in another way
- CCTV is captured to keep you, other individuals and property safe and will only be used in relation to criminal investigations.

5.1.2. Processing for relatives of a service user

We collect or use the following personal information for relatives of a service user:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Telephone call recording (P)
Live chat transcript (P)
Views and opinions (P)
CCTV recordings (P).

The lawful bases for processing your personal information as a relative of a service user or colleague are:

Consent you give consent at the time of the enquiry.
Legitimate interest:
- Your views: MHA is continuously seeking to improve. To this end we may ask you to complete a survey or give us your views in another way.
- Memorial services: If your loved one passed away at one of our homes or schemes we deem it a legitimate Interest of MHA to invite you to the service. You can opt-out of this by informing the home or scheme. We may also ask for consent to inform you of following services.
- CCTV is captured to keep you, other individuals and property safe and will only be used in relation to criminal investigations.

5.1.3. Processing for emergency contacts

We collect or use the following personal information for emergency contacts:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P).

The lawful bases for processing your personal information as an emergency contact are:

Legitimate interest, to ensure that someone is contactable in an emergency.

5.2. Where we get your personal information from

We collect your information from the following places:

The relative when making an enquiry
A colleague
A retirement living or care home resident
An MHA Communities’ member
A referral service
NHS or local authority placing a resident.

5.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention period
Waiting list for vacancy in service and general enquiries	6 months when requirements can’t be met 1 year for open enquiries, but extended with permission
Personal contact information	While you agree to being an emergency contact
Waiting list for vacancy in service for family member and general enquiries	6 months, but can be extended with permission
CCTV footage	30 days
Phone call recordings and live chat transcripts	30 days
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

5.4. Who we share your information with

MHA uses carefully selected third party service providers (Data Processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

MHA may share your Personal Information with another department within MHA if it is necessary to achieve the purpose for which the data was provided. This includes sharing your contact information with our chaplaincy team for the purpose of inviting you to a memorial service for your friend or family member within a year of their passing.

MHA may share your name and contact details with other care professionals if next of kin contact information is requested.

5.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Sugar CRM: The provider of our member management system
Radar Healthcare: The system used to records accidents and incidents.
Trusted Care Contact Centre: Some telephone calls and live chat processed on behalf of MHA. Calls may be recorded and the recordings passed to MHA and live chat transcripts may be passed to MHA.
Mediahawk: Telephone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services. MHA may share anonymised, limited details of your enquiry with Mediahawk to assist in assessing how effectively we handle requests.
Email List Verify: Used to validate email addresses prior to bulk mailing
Famileo: To invite you take advantage of a private “newspaper” service for you friend or family member in a retirement living or care home.

MHA and its data processors will not share your personal information with any other department within MHA, unless it is necessary to achieve the purpose for which the data was provided.

MHA may transfer a minimal amount of your personal data to a data processor outside the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.

Question 6

6. Marketing and fundraising: processing of personal information

Accepted Answer

To include: people interested in receiving marketing information from MHA, financial donors, fundraisers and fundraising volunteers, and supporters of our chartable aims.

This privacy notice provides information about: the personal information that MHA collects for marketing and fundraising; the ways in which your personal information may be used; and your rights.

Please note that we may use additional privacy notices to supplement this notice. We will always bring any additional privacy notice to your attention.

Please note: We made a change to the lawful basis for communicating with you by post and telephone:

After 1 May 2021: After you communicate with MHA, or complete a communication preference form, we will deem it in MHA’s legitimate interest to contact you by post or telephone regarding information that we think you would expect to receive from us, e.g. advertising our services; fundraising appeals and campaigns; and how you can support us. We will only engage with you by email or social media if you have given consent for us to do so.
Before 1 May 2021: You either gave consent (by ticking) or denied, or revoked consent, (by leaving un-ticked) for MHA to send you marketing and fundraising information. You would have also selected the preferred method of communication: post, email, phone or text.
Why are we making the change? Many people have been confused by the need to give explicit consent for communications that they expected MHA to send. In many cases this meant information that was wanted, was never received. We are therefore changing the legal basis so we can provide you information that we think you would expect to receive via post or a phone call.

We are still required to ask for explicit consent to send you marketing and fundraising information via email or text. We will always honour your latest instructions

5.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

6.1.1. Processing for providing marketing information and for non-financial supporters

We collect or use the following personal information for providing marketing information and for non-financial supporters:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P).

The lawful bases for processing your personal information for providing marketing information and for non-financial supporters are:

Legitimate interest: From 1 May 2021 we will communicate with you by post or telephone, unless you have opted-out or other preferences were made before 1 May 2021.
Consent: You have given MHA consent to send you information by email and by telephone. Before 1 May 2021 your consent also applied to postal and telephone communications.
Legal obligation: To update your preferences if you are registered with the Telephone Preference Service (TPS), Fundraising Preference Service (FPS) or similar opt-out service.

6.1.2. Processing for financial supporters of the work of MHA

We collect or use the following personal information for financial supporters:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Bank account details (P)
Debit/credit card details (P)
Gift Aid declarations (P).

The lawful bases for processing your personal information for financial supporters are:

Legitimate interest: From 1 May 2021 we will communicate with you by post or telephone, unless you have opted-out or other preferences were made before 1 May 2021.
Consent: You have given MHA consent to send you information by email and by telephone. Before 1 May 2021 your consent also applied to postal and telephone communications.
Legal obligation: MHA has a legal obligation to comply with the FCA & HMRC when processing financial donations.

6.1.3. Processing for involved in fundraising activities/events

We collect or use the following personal information for involved in fundraising activities/events:

Name (P)
Postal address (P)
Telephone number (P)
Mobile number (P)
Email address (P)
Medication information (S)
Disabilities (S)
Emergency contact details (P)
Date of birth (P)
Photos and videos (P).

The lawful bases for processing your personal information for involved in fundraising activities/events are:

Legitimate interest: From 1 May 2021 we will communicate with you by post or telephone, unless you have opted-out or other preferences were made before 1 May 2021.
Consent: You have given MHA consent to send you information by email and by telephone. Before 1 May 2021 your consent also applied to postal and telephone communications.
Contract: If you enter a competition promoted by MHA the T&Cs for a contract.

6.1.4. Processing for legacy ‘pledger’ or ‘intender’

We collect or use the following personal information for legacy ‘pledger’ or ‘intender’:

Name (P)
Postal address (P)
Telephone number (P)
Mobile number (P)
Email address (P)
Legacy details (P).

The lawful bases for processing your personal information for legacy ‘pledger’ or ‘intender’ are:

Legitimate Interest: It is in MHA’s legitimate interest to keep legacy pledgers and intended pledgers informed about the work of MHA, to help them see how their legacy may be used to enable people to live later life well. We will post occasional updates and information about legacy events.

6.1.5. Processing for Methodist Church ministers

We collect or use the following personal information for Methodist Church ministers:

Name (P)
Postal address (P)
Telephone number (P)
Mobile number (P)
Email address (P).

The lawful bases for processing your personal information for Methodist Church ministers is:

Legitimate interest: The Methodist Church provides MHA a list of ministers to allow MHA, under a signed agreement, to allow MHA to provide worship materials to churches.

6.2. Where we get your personal information from

We collect your information from the following places:

You, the supporter or fundraiser
The Methodist Church

6.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention period
Personal information	7 years from the last donation, if you have given a donation 2 years since your last contact with MHA if you have not given a donation Competition entries will be held for 12 months after the winners have been announced
Special categories of personal information	6 months after completion of the activity it was collected for
Legacy pledger or intender	As a legacy pledger or intender, we will keep your details on record so we have a record of your intent
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

6.4. Who we share your information with

MHA uses carefully selected third party service providers (Data Processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

MHA may share your Personal Information with another department within MHA if it is necessary to achieve the purpose for which the data was provided.

MHA will not sell or share your data with any other third parties.

6.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Committed Giving: To process online donations and event registrations
Blackbaud Europe Ltd: The provider of our supporter management system
Mediahawk: Phone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services. MHA may share anonymised, limited details of your enquiry with Mediahawk to assist in assessing how effectively we handle requests.
Email List Verify: Used to validate email addresses prior to bulk mailing
RSM 2000 Ltd: For managing text donations.

MHA and its data processors will not share your personal information with any other department within MHA, unless it is necessary to achieve the purpose for which the data was provided.

MHA may transfer a minimal amount of your personal data to a data processor outside the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.

Question 7

7. Sales and letting: processing of personal information

Accepted Answer

This privacy notice provides information about: the personal information that MHA collects for sales and letting; the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

7.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

7.1.1. Processing regarding an enquiry about a property

We collect or use the following personal information regarding an enquiry about a property:

Name (P)
Home address (P)
Telephone numbers (P)
Email address (P)
Telephone call recordings (P)
Residential assessment (S)
Financial assessment (P)
CCTV recordings (P)

The lawful bases for processing your personal information regarding an enquiry about a property are:

Consent you give consent at the time of the enquiry
Legitimate interest: CCTV is captured to keep you, other individuals and property safe and will only be used in relation to criminal investigations.

7.1.2. Processing for the sale or rental of a property

We collect or use the following personal information for the sale or rental of a property:

Name (P)
Home address (P)
Phone numbers (P)
Email address (P)
Telephone calls (P)
Views and opinions (P)
Sale or rental agreement (P).

The lawful bases for processing your personal information for the sale or rental of a property are:

Contract: During the rental or sale process MHA will be entering into a contract.
Legal obligation: Once the rental or sale is complete MHA has a Legal Obligation to keep records.

7.2. Where we get your personal information from

We collect your personal information from you when you make an enquiry or enter into a sale or letting agreement. If you make an enquiry via a sales or letting agent they will share your contact information.

7.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention time
Sales and letting enquiries	5 years
CCTV footage	30 days
Financial information related to rent	7 years
Resident assessments	6 years after leaving
Purchases and sales (including ‘Buy Back’)	6 years after completion
Tenancy agreement and communications relating to the agreement	6 years after leaving

7.4. Who we share your information with

MHA uses carefully selected third party service providers (Data Processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

MHA may share your Personal Information with another department within MHA if it is necessary to achieve the purpose for which the data was provided. This includes sharing your contact information with our chaplaincy team for the purpose of inviting you to a memorial service for your friend or family member within a year of their passing.

MHA may share your name and contact details with other care professionals if next of kin contact information is requested.

MHA will not sell or share your data with any other third parties.

7.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Vecta CRM: The provider of our sales and letting management system
Mediahawk: Phone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services. MHA may share anonymised, limited details of your enquiry with Mediahawk to assist in assessing how effectively we handle requests.
Email List Verify: Used to validate email addresses prior to bulk mailing
Letting or sales agents.

MHA and its data processors will not share your personal information with any other department within MHA, unless it is necessary to achieve the purpose for which the data was provided.

MHA may transfer a minimal amount of your personal data to a data processor outside the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.

Question 8

8. MHA’s website: processing of personal information

Accepted Answer

This privacy notice provides information about: the personal information that MHA collects on MHA’s website; the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

8.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

8.1.1. Processing regarding an enquiry about a property

We collect or use the following personal information of information submitted on the website:

MHA will only process the Personal Information you enter on the website for the purpose you provided it:

To request information
To process an enquiry regarding MHA’s services or opportunities
To apply for a job or volunteering opportunity
To ask about volunteering
To help with fundraising, including making a donation.

The lawful bases for processing your personal information of information submitted on the website is:

Consent you give consent at the time of submission.

8.2. Where we get your personal information from

We collect your personal information from you when you make an enquiry or submit information on our website.

8.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention period
Data submitted and stored on the website	6 months
Information forwarded regarding the enquiry, etc.	The information will be retained until the enquiry is completed and will not be stored in any additional database

8.4. Who we share your information with

MHA uses carefully selected third party service providers (Data Processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

MHA may share your Personal Information with another department within MHA if it is necessary to achieve the purpose for which the data was provided. This includes sharing your contact information with our chaplaincy team for the purpose of inviting you to a memorial service for your friend or family member within a year of their passing.

MHA may share your name and contact details with other care professionals if next of kin contact information is requested.

MHA will not sell or share your data with any other third parties.

8.4.1. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Trusted Care Contact Centre: Process some telephone call enquiries on behalf of MHA
Amazon Web Services (AWS): Website hosting
Mediahawk: Phone calls may be recorded by Mediahawk and may be analysed by artificial intelligence (AI) to help MHA improve how we market our services. MHA may share anonymised, limited details of your enquiry with Mediahawk to assist in assessing how effectively we handle requests.
Email List Verify: Used to validate email addresses prior to bulk mailing.

MHA and its data processors will not share your personal information with any other department within MHA, unless it is necessary to achieve the purpose for which the data was provided.

MHA may transfer a minimal amount of your personal data to a data processor outside the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.

Question 9

9. MHA’s mobile apps: processing of personal information

Accepted Answer

This privacy notice provides information about: the personal information that MHA via its mobile phone apps; the ways in which your personal information may be used; and your rights.

If you have provided preferences for receiving marketing or fundraising information, this will be covered by the ‘Marketing and Fundraising’ Privacy Notice.

9.1. What information we collect and use, and why

Personal information is information that can be used to identify you or is about you. Please inform us of any changes to your personal information. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and Special Categories of Personal Information (S).

9.1.1. Processing of information when using MHA’s mobile phone apps

We collect or use the following personal information when using MHA’s mobile phone apps:

Name (P)
Username (P)
Password (P)
Email address (P)
Telephone number (P)
IP address (P)
Comments (P)
Details about an enquiry (S)
MHA service engaged used: care home, retirement living scheme or community (P)
Photo for account profile (P).

MHA will only process the Personal Information you enter on the website for the purpose you provided it:

To log you in to the service
For account administration
To record your activity so we can determine which features are used and how to improve what is offered.

The lawful bases for processing your personal information when using MHA’s mobile phone apps is:

Consent you gave consent when you created your account.

9.2. Where we get your personal information from

We collect your personal information from you when you create an account or enter information in MHA’s mobile app.

9.3. How long we keep your information

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

Record type	Retention time
User account information	Until the account is closed
Records detailing the use of the app	Until the account is closed

9.4. Who we share your information with

MHA uses carefully selected third party service providers (Data Processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

MHA may share your Personal Information with another department within MHA if it is necessary to achieve the purpose for which the data was provided. This includes sharing your contact information with our chaplaincy team for the purpose of inviting you to a memorial service for your friend or family member within a year of their passing.

MHA may share your name and contact details with other care professionals if next of kin contact information is requested.

MHA will not sell or share your data with any other third parties.

9.5. Data processors

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data in the UK unless otherwise stated):

Google Play Store and the Apple Store
Disciple Media Limited, to store the App data and account information
Email List Verify: Used to validate email addresses prior to bulk mailing.

MHA and its data processors will not share your personal information with any other department within MHA, unless it is necessary to achieve the purpose for which the data was provided.

Question 10

10. Sharing information outside of the UK

Accepted Answer

MHA may transfer a minimal amount of your personal data to a data processor outside the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.

Question 11

11. Securing your information

Accepted Answer

MHA takes our duty to protect your personal information and confidentiality seriously.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your personal information is only allowed on a need-to-know basis. Those with access will only process your personal information as instructed and are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so. When your personal information is shared externally it is done so securely.

If you request to receive no further information from us your data will be stored on a suppression list to ensure that we do not contact you in future.

Question 12

12. Your data protection rights

Accepted Answer

Under the data protection legislation you have the following rights:

the right to be informed – covered by this privacy notice
the right of access – you have the right to make a subject access request asking for information about, or copies of, the information we hold and the way it is used
the right to rectification – as soon as you become aware that some information is incorrect let your line manager know or inform the data protection officer
the right to erasure – request the deletion or removal of personal information where there is no compelling reason for its continued processing
the right to restrict processing – you can request the we stop any processing if the information we are processing is incorrect
the right to data portability – you can request the personal information provided by yourself, be exported in to a universal format so it can be imported into another system
the right to object – to processing relating to marketing and profiling
the right not to be subject to automated decision-making including profiling.

To exercise any of these rights please contact the person to whom you provided your personal data or MHA’s data protection officer (see '1. Who we are and contact details').

If you are unhappy with the way that MHA has processed your personal data you can raise a complaint with the Information Commissioner’s Office (http://ico.org.uk). We would appreciate it if you could please let us know if you contact the ICO. If you feel able to contact us before you contact the ICO, we will take your concerns seriously and we promise to work with you to resolve any issues that you have (noting that we will tell you if you should refer the issue to the ICO and that we may also need to tell the ICO).

12.1. How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice. If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

Privacy policy

1. Who we are and contact details

2. MHA colleagues: processing of personal information

3. Residents and tenants: processing of personal information

4. MHA Communities members: processing of personal information

5. Relatives and emergency contacts: processing of personal information

6. Marketing and fundraising: processing of personal information

7. Sales and letting: processing of personal information

8. MHA’s website: processing of personal information

9. MHA’s mobile apps: processing of personal information

10. Sharing information outside of the UK

11. Securing your information

12. Your data protection rights