Question 1

1. Who we are and contact details

Accepted Answer

MHA is the data controller for the personal data we process. MHA is a registered charity in England and Wales (No. 1083995) and Scotland (No. SC040155) and a company limited by guarantee (No. 4043124). Our registered office is: MHA, Epworth House, Stuart Street, Derby, DE1 2EQ.

If you have any questions about this privacy notice, or wish to exercise your rights, please contact MHA’s data protection officer using the contact details below.

Email: DataProtectionOfficer@mha.org.uk
Phone: 01332 221893
Post: Data Protection Officer, MHA, Epworth House, Stuart Street, Derby, DE1 2EQ

Question 2

2. Types of personal information we collect

Accepted Answer

Personal information is information that can be used to identify you or is about you. Please contact us to provide an update if your personal information changes. MHA, or a company working on behalf of MHA, may request from you and process the following personal information (P) and special categories of personal information (S).

General personal information we may collect:

Name (P)
Home address (P)
Phone numbers (P)
Email address (P)
CCTV recordings (P)

Additional personal information we may process:

For colleagues

Colleagues include: applicants, employees, volunteers, contractors, board members

Date of birth (P)
National insurance number (P)
Bank details (P)
Professional registration information
Driving license (P)
Equal opportunity information (S)
Medical information ie Covid-19 vaccination status (S)
Criminal convictions or cautions (S)
Proof of right to work (P)
Discloser and barring service (S)
Pension information (P)
Photos (P) e.g. notice boards and badges

For residents and tenants

Date of birth / age (P)
Health and wellbeing records (S)
Next of kin or emergency contacts (P)
NHS and national insurance number (P)
Your likes and dislikes regarding your care requirements (P)
Resuscitation information (P)
Financial information (P)
Religion or religious beliefs (S)
Photos and videos (S)
Telephone calls and live chat with Trusted Care Contact Centre (P)
Information required by regulators (risk assessments, accident and incident records) (P)

For MHA Communities members

Date of birth (P)
Contacts (P): next of kin, family member, emergency contact
Wellbeing information & notes (S)
Interests and hobbies (P)
Medical background (S)
Gender and sexual orientation (S)
Ethnicity (S)
Marital status (P)
Photos and videos (P)

For MHA supporters

Supporters includes: financial donors, fundraisers and fundraising volunteers, our advocates and individuals who support the chartable aims of the organisation.

Bank account details (P)
Debit/credit card details (P)
Whether you are a UK tax payer (P)
Specific activity information e.g. medication (S), disabilities (S), emergency contact details (P), date of birth (P)
Photos and videos (P)
Political views (S)

Your personal information may be collected when you:

ask about our activities
make a donation to us
register for an event
engage with us on social media, or
order products and services
participate in campaigns

When you are using our secure online donation pages or text donation service, your donation is processed by a third party payment Data Processor with whom MHA has a contract.

If you use your credit or debit card to donate to us, we will ensure your payment is processed securely and in accordance with the Payment Card Industry Data Security Standard. We do not store your credit or debit card details following the completion of your transaction. Card transactions are only processed by authorised staff.

We do not usually collect special categories of personal information about you unless there is a clear reason for doing so, such as participation in an event where we need this information to ensure we provide appropriate facilities for you. We will ensure that special category personal information is only retained for the length of time necessary to fulfil the required service.

For relatives and emergency contact

Telephone calls and live chat with Trusted Care Contact Centre (P)
Views and opinions

For website users

IP address (P)
Opinions (P)
Comments (P)
Information regarding an enquiry (P)
Live chat with Trusted Care Contact Centre (P)

Question 3

3. Our lawful basis for the processing of personal information

Accepted Answer

For colleagues

The legal basis for processing your personal data is either:

Contract - MHA will process your personal information to fulfil the contract (incl. volunteering agreement) or to take steps to enter into a contract (the legal basis)
Legal Obligations - MHA has a legal obligation to process your personal data regarding your: ‘right to work’, salary, national insurance and PAYE Tax and regarding your pension.

Some of processing may be carried out by external organisations (Data Processors) under a contract. MHA’s Data Processors include (data in the UK unless otherwise stated):

Human resource processing, including MyMHA (data in the UK and the EU)
Identity service provider (IDSP) to check your ‘right to work’ as required by the Home Office.
Disclosure and barring service (DBS) as MHA is required to carry out DBS checks for all colleagues working with vulnerable adults.
Payroll services
Pension contributions
Training records (data in the USA and Australia protected by Controller to Processor Standard Contractual Clauses)
Workplace by Meta (data in the USA protected by Controller to Processor Standard Contractual Clauses).

For residents and tenants

The legal basis for this processing is either:

Contract – privately funded residents: to fulfil the agreement between the resident, or their legal representative, and MHA.
Legitimate interest – residents funded by a local authority (LA) or clinical commissioning group (CCG): in order for MHA to fulfil the contract with the funding body. MHA may receive from the funding body personal information to help determine if MHA can meet your needs, this may include health and wellbeing information.

Some of processing may be carried out by external organisations (Data Processors) under a contract. MHA’s data processors include (data stays in the UK unless otherwise stated):

Trusted Care Contact Centre. Phone calls and live chat processed on behalf of MHA. Calls may be recorded and the recordings passed to MHA and live chat transcripts may be passed to MHA.

MHA will only process the personal information:

To record your enquiry into services offered by MHA
To assess your residential and care needs
To assess your financial situation
To provide residential and care services.

One of MHA’s values is to, “nurture mind, body and spirit”. To facilitate this MHA’s internal care team includes: nurses, carers, chaplains and music therapists.

For MHA Communities members

The legal basis for processing your information is that you provide consent through completion of the MHA Communities member assessment form. The scheme will only process your personal information:

To aid in determining membership to the scheme
For MHA Communities membership administration
For provision of activities
To provide wellbeing support
To development our services
Contacts will only be contacted to ensure you are ok or in an emergency
Medical information will only be used in an emergency and will only be provided to medical professionals. Copies may be taken on trips or holidays.
Housing information will be used to assist with home visits
Anonymised for statistical analysis in reports

MHA asks for specific consent to:

Provide your name and phone number to providers of services that MHA cannot provide
Provide suggestions based on the equalities information provided

For MHA supporters

MHA will use your personal information:

For administration purposes - e.g. to keep a record of our relationship with you, contact you about an event you have registered for or about a donation you have made
To process any donations we receive from you, including the processing of Gift Aid
To provide information you have requested.
For marketing and fundraising:
- To provide information about campaigns and appeals
- To tell you how you can support the work of MHA
- To promote the work of MHA
- To advertise our services and products we have for sale.
To ask for your help:
- With research or surveys
- With campaigns on issues affecting older people
- To analyse and improve the services we offer
- For the provision or worship service materials
- As legally required - e.g. HM Revenue and Customs (HMRC) require us to keep financial transaction information for 7 years.

The legal basis for this processing is either (please see the note on page 1):

Legitimate interest – From 1 May 2021 we will communicate with you by post or telephone where it is deemed in MHA’s legitimate interest, unless you have asked us not to contact you or other preferences were made before 1 May 2021. This includes sending you marketing and fundraising information, e.g. advertising our services; fundraising appeals and campaigns; and how you can support us. You have the right to opt-out of receiving this information.
Consent – You have given MHA consent to send you information, by ticking a box on a form or returned letter, allowing us to contact you by email and by telephone. Before 01 May 2021 your consent also applied to postal and telephone communications. You may change your mind and revoke your consent at any time.
Contract – If you enter a competition promoted by MHA the legal basis for processing your personal data is a contract, as specified in the terms and conditions of the competition.
Legal obligation – MHA has a legal obligation to process your data including:
- When you make a donation to MHA (to comply with HMRC)
- To update your preferences if you are registered with the Telephone Preference Service (TPS), Fundraising Preference Service (FPS) or similar opt-out service. If your preferences are registered or updated with MHA after your registration with an opt-out service, we will honour your latest instructions.

For relatives and emergency contacts

The legal basis for this processing is legitimate interest as an MHA resident, MHA Communities member or staff member (your friend or family member) has provided your details as a point of contact, including for use in an emergency.

As an emergency contact we may place your contact details in an emergency “grab and go” bag for use if the service needs to be evacuated. If you do not want your contact used for this purpose please inform the MHA home or housing scheme.

You can opt-out of being an emergency contact by informing the MHA service or MHA’s data protection officer.

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data stays in the UK unless otherwise stated):

Trusted Care Contact Centre. Phone calls and live chat processed on behalf of MHA. Calls may be recorded and the recordings passed to MHA and live chat transcripts may be passed to MHA.

For property sales and letting

MHA will only process your personal information to:

keep you updated about property offers
help you through the rental or sale and purchase process

The legal basis for this processing is either:

Consent - During the enquiry process you will have provided consent for MHA to keep you updated. You can withdraw this consent at any time.
Contract - During the rental or sale process MHA will be entering into a contract.
Legal obligation - Once the rental or sale is complete MHA has a Legal Obligation to keep records.

For website users

MHA will only process the personal information you enter on the website for the purpose you provided it:

To request information
To process an enquiry regarding MHA’s services
To help with fundraising, including making a donation
To apply for a job
To ask about volunteering.

The legal basis for this processing is consent – you ticked a box to give us permission to contact you or completed an enquiry form asking us to contact you.

Some of processing may be carried out by external organisations (data processors) under a contract. MHA’s data processors include (data stays in the UK unless otherwise stated):

Trusted Care Contact Centre. Live chat processed on behalf of MHA. Live chat transcripts may be passed to MHA.

If consent has been given for MHA to process your personal data you can withdraw consent at any time.

Legitimate Interest processing

MHA may process your personal data where they have a Legitimate Interest to do do so. For all such processing you will be provided the option to 'opt-out' of the processing.

Photos and videos for promoting MHA

MHA may use photos or videos for:

Publicity, fundraising and advertising materials, including printed publications
Presentation and exhibition materials
Websites, social media channels and digital communications
News media and their associated websites and social media channels including print, television and radio.

Personal photos: MHA will ask for your consent to use photos or videos, in which you are a focal point, taken by colleagues, professionals or third party agencies on behalf of MHA. MHA may contact you as the five year retention period comes to an end to ask for consent to continue using the photos or video.

Group or event photos: MHA may take photos during activities or events which include multiple people, where you are not the primary focus. The legal basis for taking these photos is legitimate interest. During such activities or events you will be informed where the photos or filming will take place allowing you to move in or out of camera shot.

Your views - surveys, etc

MHA is continuously seeking to improve. To help us in our process we have a legitimate interest to seek feedback and opinions from our colleagues. To this end we may occasionally ask you to: complete a survey, take part in a discussion group, or give us your views in another way. If you would rather not be invited to participate please let us know and we will record your desire to opt-out.

Next of kin and emergency contacts

Next of kin and emergency contact details are requested to help protect your vital interest by having points of contact for use only in emergency situations.

Additional legitimate interest processing

For colleagues:

Workplace by Meta
Workplace by Meta is part of MHA’s internal communication strategy. Accounts are created on Workplace for all colleagues as MHA has a legitimate interest to encourage colleagues to communicate to promote ‘One MHA’.

Skills for Care
MHA uploads pseudonymised data to the Adult Social Care Workforce Data Set - you can’t be identified. The data is combined with that of other social care providers to help the Department for Health and Social Care (DHSC), local authorities and the Care Quality Commission (CQC) to plan, fund and monitor the sector. MHA has a legitimate interest to share this data so that funding for training can be received.

Working from home and sharing your address:
MHA has a legitimate interest to share your home addresses for a business requirement, e.g. to deliver or collect business related items. Sharing of your home address will be on a need to know basis and only for business related services.

For residents and tenants:

Building maintenance and utilities
MHA may share limited contact information of residents living in our retirement living schemes with building maintenance contractors and utility providers (e.g. gas and electricity providers). The legal basis for this is legitimate interest as we need to ensure that our buildings are maintained and repaired and that utilities are provided.

For MHA supporters:

Legacy 'pledger' or 'intender'
It is in MHA’s legitimate interest to keep legacy pledgers and intended pledgers informed, about the work of MHA, to help them see how their legacy may be used to enable people to live later life well. We will post occasional updates and information about legacy events. You can opt-out at any time.

Worship materials
The Methodist Church provides MHA a list of ministers to allow MHA, under a signed agreement, to provide worship materials and fundraising material to the churches. MHA provides this information as it has a legitimate interest in helping the church which such services. Ministers have the right to opt-out of receiving this information.

For relatives and emergency contacts:

Memorial services
MHA’s homes and schemes often hold memorial services to commemorate loved ones that have passed away in the previous year. If your love one passed away at one of our homes or schemes we deem it a legitimate Interest of MHA to invite you to the service. You can opt-out of this by informing the home or scheme. We may also ask for consent to inform you of following services.

Question 4

4. Sharing your information

Accepted Answer

MHA may share your personal data with third parties or data processes as detailed below or where there is a legal requirement for MHA to share the information. MHA may share your personal information with another department within MHA if it is necessary to achieve the purpose for which the data was provided.

MHA will not sell or swap your data with any third parties. We will not share your information with any third party for marketing purposes.

For colleagues

MHA may share a minimal amount of your personal information with:

MHA’s insurance company in relation to claims or possible claims.
Organisations requesting an employment reference. MHA will only provide: ‘job title’, ‘start date’, ‘end date’ (if you have left) and ‘reason for leaving’ for colleagues in care homes and retirement living locations applying for a post in a regulated care service. Additional information will only be provided with your consent.

For residents and tenants

MHA may share a minimal amount of your personal information with:

Other healthcare professionals including GPs, nurses, pharmacies and hospitals
Designated professionals (e.g. care home staff, social worker), including NHS teams, to support care and process funding requests
The organisation (LA or CCG) for whom we provide the service under a contract
People with power of attorney, deputyship or people you have authorised access or when it is in your best interest
MHA’s insurance company in relation to claims or possible claims
Building maintenance contractors to allow for repairs (retirement living residents)
Utility providers to aid an easy transition into your new home (retirement living residents). You will obviously be free to change your utility provider as and when you desire.

MHA may share your next of kin’s contact information with other care professionals if requested.

MHA will not share your information with any third party for marketing, planning or research purposes, including purposes for which the national data opt-out would apply.

For MHA Communities members

Your name and address may be shared with, a DBS (criminal records) checked, befriender/volunteer to assist with home visits or transportation with your consent.

Individuals for whom you provide contact details (e.g. emergency contacts) may be informed that their details are being retained for emergency or general concern purposes, asking them to provide updates as appropriate.

Medical information may be shared with medical professionals for your vital interests.

The scheme will not share other Personal Information provided for the membership with any external parties without your consent.

For MHA supporters

MHA uses carefully selected third party service providers (data processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

For relatives and emergency contacts

MHA uses carefully selected third party service providers (data processors), under contract, for the purposes of completing tasks and providing services to you on our behalf (e.g. to process donations and to send mailings). They will only use your data as instructed by MHA.

MHA may share your personal information with our chaplaincy team for the purpose of inviting you to a memorial service for your friend or family member within a year of their passing.

MHA may share your name and contact details with other care professionals if next of kin contact information is requested.

For property sales and letting

MHA uses carefully selected third party service providers (data processors), under contract, for the purposes of completing tasks and providing services to you on our behalf. They will only use your data as instructed by MHA.

For website users

We may share your personal information with the relevant internal department in order to process your request. They will then contact you regarding your enquiry or the information you have provided, but not retain your information once the enquiry is completed.

Question 5

5. Transfers information outside of the UK and the European Economic Area (EEA)

Accepted Answer

MHA will not transfer your information outside of the UK or the European Economic Area, except:

For colleagues: MHA may transfer a minimal amount of your personal data to a data processor outside the UK as detailed in “3. Our lawful basis for the processing of personal information”. MHA has a contract in place with these data processors which includes ensuring that your personal data is protected, typically by an Adequacy Agreement (EU) or by Standard Contractual Clauses (USA).

Question 6

6. Securing your information

Accepted Answer

MHA takes our duty to protect your personal information and confidentiality seriously.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your personal information is only allowed on a need-to-know basis. Those with access will only process your personal information as instructed and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

When your personal information is shared externally it is done so securely:

Email: When information is shared via email it encrypted in transit. Methods include: 1) as a password protected file, 2) using Egress or similar secure email solution, and 3) to recipients accredited by NHS Digital as secure according to their Secure Email Standard (DCB1596) to which MHA is accredited.
Post: Using a sign for mail service, e.g. the Royal Mail “Sign For” service or other courier service requiring a signature on delivery.

Question 7

7. Retention of your personal information

Accepted Answer

MHA will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. At the end of the retention period your information will either be securely and confidentially destroyed or anonymized. Anonymisation is the process of removing personal information from the data so that it is not possible to identify individuals from the data.

If you request to receive no further information from us your data will be stored on a suppression list to ensure that we do not contact you in future.

For colleagues, volunteers and Board members

Record type	Retention period
Application Records (CV, application form, etc) including vaccination status, e.g. seasonal flu and covid.	1 year for unsuccessful applicants 6 years after leaving for successful applicants
Terms and conditions, agreements	6 years after leaving
Personal File: 1:1’s, Appraisals, disciplinary records, absence records, pay & benefits information, training records	6 years after leaving
CCTV recordings	30 days
Access to Vivup and information shared with Vivup	During your employment if you have registered for the service
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

For residents and tenants

Record type	Retention period
Waiting list for vacancy in service and general enquiries	6 months when requirements can’t be met 1 year for open enquiries, but extended with permission
Application forms and assessment information	6 months if the individual doesn’t move in 8 years after leaving MHA
Care records	8 years after leaving MHA
Finance records	7 years
Accident and incident records	10 years
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

For MHA Communities members

Record type	Retention period
Referrals	6 months
Membership form (members)	1 years after leaving the scheme
Membership form (for those who do not become members)	6 months after initial assessment
Health information for trips, events and holidays	Destroyed within 1 week of event
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

For charitable supporters

Record type	Retention period
Personal information	7 years from the last donation, if you have given a donation 2 years since your last contact with MHA if you have not given a donation Competition entries will be held for 12 months after the winners have been announced
Special categories of personal information	6 months after completion of the activity it was collected for
Legacy pledger or intender	As a legacy pledger or intender, we will keep your details on record so we have a record of your intent
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

For relatives and emergency contacts

Record type	Retention period
Waiting list for vacancy in service and general enquiries	6 months when requirements can’t be met 1 year for open enquiries, but extended with permission
Personal contact information	While you agree to being an emergency contact
Waiting list for vacancy in service for family member and general enquiries	6 months, but can be extended with permission
CCTV footage	30 days
Photos, videos and quotes	5 years
Your views, surveys, etc	3 years

For property sales and letting

Record type	Retention time
Sales and letting enquiries	5 years
Financial information related to rent	7 years
Resident assessments	6 years after leaving
Purchases and sales (including ‘Buy Back’)	6 years after completion
Tenancy agreement and communications relating to the agreement	6 years after leaving

For website users

Record type	Retention period
Data submitted and stored on the website	6 months
Information forwarded regarding the enquiry, etc.	The information will be retained until the enquiry is completed and will not be stored in any additional database

Question 8

8. Your data protection rights

Accepted Answer

Under the data protection legislation you have the following rights:

the right to be informed – covered by this privacy notice
the right of access – you have the right to make a subject access request asking for information about, or copies of, the information we hold and the way it is used
the right to rectification – as soon as you become aware that some information is incorrect let your line manager know or inform the data protection officer
the right to erasure – request the deletion or removal of personal information where there is no compelling reason for its continued processing
the right to restrict processing – you can request the we stop any processing if the information we are processing is incorrect
the right to data portability – you can request the personal information provided by yourself, be exported in to a universal format so it can be imported into another system
the right to object – to processing relating to marketing and profiling
the right not to be subject to automated decision-making including profiling.

To exercise any of these rights please contact the person to whom you provided your personal data or MHA’s data protection officer (see '1. Who we are and contact details').

If you are unhappy with the way that MHA has processed your personal data you can raise a complaint with the Information Commissioner’s Office (http://ico.org.uk). We would appreciate it if you could please let us know if you contact the ICO. If you feel able to contact us before you contact the ICO, we will take your concerns seriously and we promise to work with you to resolve any issues that you have (noting that we will tell you if you should refer the issue to the ICO and that we may also need to tell the ICO).

Question 9

9. Changes to this privacy policy

Accepted Answer

We reserve the right to update this privacy policy at any time where appropriate.

We have made a change to the legal basis for communicating with you by post and telephone:

After 1 May 2021: After you communicate with MHA, or complete a communication preference form, we will deem it in MHA’s Legitimate Interest to contact you by post or telephone regarding information that we think you would expect to receive from us, e.g. advertising our services; fundraising appeals and campaigns; and how you can support us. You will always be offered the opportunity to opt-out of being provided this information.
Before 1 May 2021: You may have completed a communication preference form and either given consent (by ticking) or denied, or revoked consent, (by leaving un-ticked) for MHA to contact you. This form detailed how MHA could send you marketing and fundraising information, e.g. advertising our services; fundraising appeals and campaigns; and how you can support us. You would have also selected the means by which you would like to hear from us: post, email, phone or text. Any preferences recorded before 01 May 2021 will be respected until your preferences are updated.
Why have we made this change? Many people have been confused by the need to give explicit consent for communications that they expected MHA to send. In many cases this meant information that was wanted, was never received. We are therefore changing the legal basis so we can provide you information that we think you would expect to receive via post or a phone call.

We are still required to ask for explicit consent to send you marketing and fundraising information via email or text. We will always honour your latest instructions.

Privacy policy

1. Who we are and contact details

2. Types of personal information we collect

3. Our lawful basis for the processing of personal information

4. Sharing your information

5. Transfers information outside of the UK and the European Economic Area (EEA)

6. Securing your information

7. Retention of your personal information

8. Your data protection rights

9. Changes to this privacy policy