LifeCare (Edinburgh) offers a range of care services tailored for people in their mid to later years who have dementia, mobility difficulties or are socially isolated. We operate premises across Edinburgh with our head office at Stockbridge House, 2 Cheyne Street, Edinburgh, EH4 1JB, United Kingdom. We are a company limited by guarantee (SC286315) and a registered charity (SC012641) regulated by the Scottish Charity Regulator (OSCR). Our services are also regulated by the Care Inspectorate. We also run Vintage Vibes which is a partnership between LifeCare Edinburgh and The Broomhouse Centre.

This Policy explains when and why we collect personal information about people who visit our website, how we use it, the conditions under which we may disclose it to others and how we keep it secure.

LifeCare (Edinburgh) is fully committed to handling personal information in accordance with data protection legislation and best data protection practices. This means that your personal information will be:

• Processed lawfully, fairly, and in a transparent manner.
• Collected for specified, explicit and legitimate purposes.
• Only collected so far as required for our lawful purposes.
• As accurate and up to date as possible.
• Retained for a reasonable period of time, in accordance with retention policies.
• Processed in a manner which ensures an appropriate level of security.

Whether through this notice or otherwise, we hope to ensure that everyone has a good understanding of why we processes personal information and, where we do, the rights they may have.

We obtain information about you when you use our website, for example, when you contact us about products and services, to make a donation, or if you register to receive our newsletter. In addition, like most organisations that handle personal information, there are various ways in which we collect information from the people we deal with.

• Email and written correspondence
• Telephone discussions
• Visitors to our website
• Social media
• Application forms and other information requests
• Direct contact at our offices and elsewhere

In nearly all instances, it should be obvious to you when we are collecting your personal data.

The personal information most commonly collected is as follows:

• Name.
• Contact details (including home and business addresses, email, telephone number).
• For visitors to our website – your IP address, and information regarding what pages are accessed and when.
• If you make a donation online or purchase a service from us, your card information is not held by us, it is collected by our third party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions.
• Date of birth.
• Records of enquiries, meetings and other direct engagement.
• Copies of physical and electronic correspondence.

We may use your information to:

• process a donation that you have made;
• process orders that you have submitted;
• to carry out our obligations arising from any contracts entered into by you and us;
• dealing with entries into a competition;
• seek your views or comments on the services we provide;
• notify you of changes to our services;
• send you communications which you have requested and that may be of interest to you. These may include information about campaigns, appeals, other fundraising activities, promotions of our associated partnerships goods and services; and
• process a grant or job application.

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory and regulatory obligations (for example the collection of Gift Aid, or satisfying the requirements of the Care Inspectorate). We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us.

We will only process personal information where we believe we have a lawful basis to do so. The basis for processing will vary from activity to activity. In some instances, processing may have more than one lawful basis.

The following information below summarises the basis on which we process personal information.

Lawful Basis

Processing is necessary for us to meet our legitimate interests as a care service provider, including:

• the maintenance of our customer / service user database, the promotion and monitoring of professional standards, and delivery of services we provide to customers / service users.
• processing carried out in the public interest
• processing necessary for us to comply with our legal obligations.
• consent

Examples of Processing Activities

• General administration for maintaining our customer / service user database.
• Corresponding with customers / service users in respect of the delivery of services within the terms of our specific contracts
• Regulatory activity (e.g. complying with the requirements of OSCR and the Care Inspectorate, and fulfilling our responsibilities with regards applicable legislation).
• Providing customers / service users with relevant news and updates which may be of interest to them
• Regulatory activity (e.g. complying with requirements of OSCR and the Care Inspectorate and fulfilling our responsibilities with regards applicable legislation).
• Providing information to oversight regulators (including OSCR and the Care Inspectorate).
• Providing information to statutory bodies (e.g. HMRC).
• Providing information to law enforcement agencies.
• Providing customers / service users and donors with relevant news and updates, marketing and other information.
• Use of financial and other information relevant to the delivery of services provided to our customers / service users.

We will not sell or rent your information to third parties.

We will not share your information with third parties for marketing purposes.

However, in certain circumstances some of the processing activities set out above require us to share personal information with third parties. Whenever we share personal data, we take all reasonable steps to ensure it will be handled appropriately and securely by the third party.

We may pass your information to our third party service providers working on our behalf, including: agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example to process donations and send you mailings). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties for them to use for their own purposes, unless you have requested us to do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.

Third Party Product Providers we work in association with

As part of the Vintage Vibes partnership we work with the Broomhouse Centre to deliver companionship services to the over-60s. When you enquire about these services through our website, Vintage Vibes will use your details to provide you with information and carry out their obligations arising from any agreements you have entered into with them. In this case, LifeCare will be acting as a data controller of your information in accordance with this Privacy Policy. Vintage Vibes will also share your information with us which we will use in accordance with this Privacy Policy.

When you are using our secure online donation pages, your donation is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us.

The following is a list of the main third parties with whom we share personal information:

• Oversight regulators and statutory bodies (e.g. HMRC, OSCR and the Care Inspectorate).
• Local authorities and health care agencies, such as the NHS,
• Software providers which allow us to operate efficient digital processes, including:
  • Xero (accounting software)
  • eTapestry (fund raising database)

For practical reasons, this is an indicative, but not exhaustive list. Please also note that the list may be updated from time to time.

In the event of an unpaid account or disputed account, we will instruct our appointed debt recovery agents/solicitors to proceed with the necessary course of action to retrieve any monies due to our Company without prior consent from the customer. Only information held that is relevant to the matter in hand will be passed to our appointed third party agents.

The periods for which we retain personal information depends on the purpose for which the information was obtained but, in general terms, we will retain personal data for so long as required by law, or as may be required for record keeping and legal claims purposes.

Personal information is mostly processed by our staff at our premises in Edinburgh. To allow us to operate efficient digital processes, we sometimes need to store information in servers located outside of the European Economic Area (‘EEA’), but in the majority of cases your data will remain within the UK. By way of example, this may happen if any of our servers are from time to time located in a country outside of the EEA. These countries may not have similar data protection laws to the UK. By submitting your personal data, you’re agreeing to this transfer, storing or processing. If we transfer your information outside of the EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this Policy.

We may hold your information on our cloud based funding system where the servers are located in the United States. There is an adequacy decision by the European Commission in respect of the United States. This means that the United States to which we transfer your data are deemed to provide an adequate level of protection for your personal information.

However, to ensure that your personal information does receive an adequate level of protection we have put in place the following appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection: For example, a binding service contract which includes data access, data security and information sharing clauses. If you require further information about these protective measures, you can request it using the contact details below.

We may collect information about the computer or device which is used to access our website. We use this information to improve the user experience and to help us better understand the ways in which our website is used. This may include information about:

• The computer or device type.
• IP Addresses
• Operating system.
• Browser type and version.
• Time zone setting and browser plug-in types and versions.

This is statistical data about our users’ browsing actions and patterns. It is collected on an anonymous, aggregated basis, and does not identify individual users.

When you give us personal information, we take steps to ensure that it’s treated securely. Any personal information provided to us via our website is encrypted and protected using SSL encryption. When you are on a secure page, a lock icon will appear on the URL bar of the web browser such as Microsoft Internet Explorer, or the web address will start https://

Non-sensitive details (your email address etc.) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

We may analyse the personal information which you have submitted to create a profile of your interests and preferences so that we can contact you with information relevant to you. We do not make use of additional information about you from external sources. In some circumstances we may use your personal information to detect and reduce fraud and credit risk.

Our website makes use of cookie files to distinguish you from other users of our site, to provide you with a bespoke user experience tailored to your individual preferences. A cookie file (a small file of letters and numbers) will be placed on your computer or other access device each time you visit our site.

We also use analytical cookie files. These allow us to recognise and count the number of visitors to our site and to see how visitors move around our site when they are using it. This helps us to improve the way our site works, for example, by ensuring that users are finding what they are looking for easily.

If you wish to delete any such cookie files, please refer to the instructions for your file management software to locate the file or directory that stores cookies. Our cookies will contain the domain name lifecareedinburgh.org.uk within the file name.

You may refuse to accept cookie files when visiting our site, by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you choose this setting, you may not get an optimal web site experience and be unable to access certain parts of our site.

Our website and emails may contain links to other websites. We are not responsible for the content or practices of these other sites and we recommend that you check their own privacy policies.

The law in the UK gives certain rights to individuals whose information is being processed by a third party. The following is a quick summary of these rights:

• Access to your information – you have the right to request a copy of the personal information about you that we hold.
• Correcting your information – we want to make sure that your personal information is accurate, complete, and up to date, and so you may ask us to correct any personal information about you that you believe does not meet these standards.
• Deletion of your information – you have the right to ask us to delete personal information about you where:
  • You consider that we no longer require the information for the purposes for which it was obtained
  • We are using that information with your consent and you have withdrawn your consent – see ‘withdrawing consent to using your information’ below.
  • You have validly objected to our use of your personal information – see ‘objecting to how we may use your information’ below.
  • Our use of your personal information is contrary to law or our other legal obligations.
• Objecting to how we may use your information – you have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest, or in exercising official authority vested in us then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
• Restricting how we may use your information – in some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold, or assessing the validity of any objection you have made to our use of your information. The right might also apply if we no longer have a basis for using your personal information but you don’t want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims, or where there are other public interest grounds to do so.
• Withdrawing consent using your information – where we use your personal information with your consent, you may withdraw that consent at any time, and we will stop using your personal information for the purpose(s) for which consent was given.

Please contact us in any of the ways set out in the ‘contact information and further advice’ section if you wish to exercise any of these rights.

We keep this notice under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained by emailing enquiries@lifecare-edinburgh.org.uk or in writing to our office at Stockbridge House, 2 Cheyne Street, Edinburgh, EH4 1JB, United Kingdom

This privacy statement was last updated in April 2018.

You have a choice about whether or not you wish to receive information from us. If you do not want to receive direct marketing communications from us about the services we offer for older people you can select your choices by ticking the relevant boxes situated on the form on which we collect your information.

We will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted. You can change your marketing preferences at any time by contacting us by email: enquiries@lifecare-edinburgh.org.uk or telephone on 0131 343 0940

If you have any questions which are not covered in this notice, we suggest that you email us through enquiries@lifecare-edinburgh.org.uk. To help us deal with your query as quickly as possible, we recommend that you include the following in the email subject ‘FAO Data Protection Lead’. If you would prefer to submit your questions in writing, please write to our office at Stockbridge House, 2 Cheyne Street, Edinburgh, EH4 1JB, United Kingdom addressing your letter to the Data Protection Lead.

While we seek to resolve directly all complaints about how we handle personal information, you also have the right to lodge a complaint with the Information Commissioner’s Office, whose contact details are as follows:

The Information Commissioner’s Office – Scotland
45 Melville Street
Edinburgh
EH3 7HL
Telephone: 0303 123 1115

Email – Scotland@ico.org.uk

Website – https://ico.org.uk/concerns