Privacy Policy

Burghley Care is committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, contact us, enquire about our homes or services, apply for a role, visit one of our homes, or otherwise interact with us.

For the purposes of data protection law, Burghley Care will be the data controller of your personal data where we decide how and why your personal information is used.

If you have any questions about this Privacy Policy or how we handle your data, please contact us using the details provided on our website.

The personal information we may collect

Depending on how you interact with us, we may collect and process personal information such as:

  • your name

  • postal address

  • email address

  • telephone number

  • information you provide in enquiry forms or correspondence

  • details relating to a prospective resident enquiry

  • information required to support care enquiries, admissions or assessments

  • visitor information where required for security, safety or safeguarding

  • recruitment information, such as your CV, employment history and references

  • supplier or contractor contact information

  • website usage data, including IP address, browser type and information collected through cookies

  • CCTV footage where this is used in and around our homes for safety, security and safeguarding purposes

Special category data

In some circumstances, we may need to process more sensitive personal information, known as special category data. This may include information about health, care needs, accessibility requirements, racial or ethnic origin, religion or other information relevant to the safe delivery of care or support.

Where we process special category data, we will only do so where the law allows and where an appropriate lawful basis and additional condition for processing applies. Under UK GDPR, organisations must identify both a lawful basis under Article 6 and a separate condition under Article 9 when processing special category data.

How we collect personal information

We may collect personal information:

  • directly from you

  • from a family member, representative or advocate acting on your behalf

  • through forms completed on our website

  • when you contact us by phone, email, post or in person

  • during admissions, care planning or service enquiries

  • from recruitment processes

  • from third parties where appropriate, such as referees, regulators, healthcare professionals, local authorities or publicly available sources

  • through website cookies and analytics tools

  • through security systems such as CCTV or visitor sign in systems where these are used

How we use personal information

We may use your personal information to:

  • respond to enquiries and provide information about our homes and services

  • assess suitability for care and support services

  • communicate with residents, families, representatives, visitors and professionals

  • manage admissions and ongoing care related administration

  • meet legal, regulatory, safeguarding and health and safety obligations

  • manage recruitment and employment related processes

  • administer contracts and relationships with suppliers and contractors

  • maintain the safety and security of our homes, systems and website

  • improve our website, services and communications

  • deal with complaints, feedback, incidents or legal claims

  • comply with lawful requests from regulators, local authorities, courts, law enforcement or other public bodies where required

Lawful bases for processing

We process personal data only where we have a lawful basis for doing so. Depending on the circumstances, this may include:

  • consent

  • performance of a contract

  • compliance with a legal obligation

  • protection of vital interests

  • legitimate interests

  • provision and management of health or social care services, where applicable

The ICO states that at least one lawful basis under Article 6 UK GDPR must apply whenever personal data is processed, and privacy notices should explain which lawful basis is being relied on.

Where we rely on legitimate interests, we will do so only where those interests are not overridden by your rights and freedoms.

Where we rely on consent, you may withdraw that consent at any time, although this will not affect the lawfulness of any processing carried out before consent was withdrawn.

Sharing personal information

We may share personal information where necessary and appropriate with:

  • healthcare professionals and care related partners

  • local authorities and commissioners

  • regulators and inspectors

  • safeguarding bodies

  • insurers, legal advisers, auditors and other professional advisers

  • IT providers, website providers and software providers

  • recruitment service providers

  • payment, finance or administrative service providers

  • emergency services or other authorities where required

  • contractors or suppliers working on our behalf

Where third parties process personal data on our behalf, we expect them to do so securely, lawfully and only for authorised purposes. The ICO makes clear that organisations must identify a lawful basis before sharing personal data.

Website analytics and cookies

Our website may use cookies and similar technologies to help it function, understand how it is used and improve the user experience.

For more information, please see our Cookie Policy.

International transfers

In some cases, personal information may be stored or accessed outside the UK, for example where service providers use overseas infrastructure or support teams.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place in line with UK data protection law. The ICO explains that transfers of personal information outside the UK are subject to specific UK GDPR rules and safeguards.

How long we keep personal information

We will only keep personal information for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, safeguarding, insurance, tax, employment and operational requirements.

Retention periods may vary depending on the type of information and the reason it was collected.

Security of personal information

We take appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

Your rights

Under UK data protection law, you may have the right to:

  • be informed about how your personal data is used

  • request access to the personal data we hold about you

  • request correction of inaccurate or incomplete data

  • request erasure of your personal data in certain circumstances

  • request restriction of processing in certain circumstances

  • object to processing in certain circumstances

  • request data portability where applicable

  • withdraw consent where consent is the basis for processing

  • complain to the Information Commissioner’s Office if you are unhappy with how your data has been handled

The ICO explains that UK GDPR gives individuals rights including access, rectification, erasure, restriction, objection and, in some cases, portability.

If you would like to exercise any of your rights, please contact us using the details on our website.

You also have the right to make a complaint to the Information Commissioner’s Office.