1. Introduction:
Westerfield House Care Ltd is strongly committed to ensuring that your privacy is protected. The information we hold about you is treated as confidential and is held and processed in accordance with current legislation. If the processing of personal data is necessary and there is no statutory basis for such processing, we will obtain consent from the data subject. Personal Data processing shall always be in line with the General Data Protection Regulation (GDPR). By means of this Privacy Notice, we would like to inform the general public why we collect and process personal data and Data Subjects’ rights relating to the collection and processing of Personal Data.
2. Definitions:
The data protection notice of Westerfield House Care Limited is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR) but for ease of understanding the following definitions apply.
Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Personal data: any information relating to an identified or identifiable natural person ("Data Subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject: any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.
Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall follow the applicable data protection rules according to the purposes of the processing.
Third Party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future.
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Consent: Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
3. Details of the Controller
Mr M Khan
Westerfield House
Humber Doucy Lane
Ipswich, Suffolk
IP4 3QG
Tel: 01473 232974
4. Cookies
We use technologies, such as cookies, to customise content and advertising, to provide social media features and to analyse traffic to the site. We also share information about your use of our site with our trusted social media, advertising and analytics partners. This helps us to provide you with a good experience when you browse our site and also allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer. We only use (and store) non-essential cookies on your computer's browser or hard drive if you provide your consent.
Services we use which include Cookies:
Service Cookie Name Expiry Description
Facebook Facebook Pixel 30 days It helps you track conversions from Facebook ads, optimize ads based on collected data, build targeted audiences for future ads, and remarket to qualified leads
Google Analytics
_ga 2 years Used to distinguish users.
_gid 24 hours Used to distinguish users.
_gat 1 minute Used to throttle request rate. If Google Analytics is deployed via Google Tag Manager, this cookie will be named _dc_gtm_<property-id>.
AMP_TOKEN 30 seconds to 1 year
Contains a token that can be used to retrieve a Client ID from AMP Client ID service. Other possible values indicate opt-out, inflight request or an error retrieving a Client ID from AMP Client ID service.
_gac_<property-id> 90 days Contains campaign related information for the user. If you have linked your Google Analytics and Google Ads accounts, Google Ads website conversion tags will read this cookie unless you opt-out.
Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services or messaging services) may also use cookies, which we do not have any control over. These cookies are likely to be analytical/performance cookies or targeting cookies.
You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies you may not be able to access all or parts of our site.
5. Reasons/Purposes for Processing Information
Generally, we will collect, use and hold your information for the purposes of:
• Assessing applications for and providing Westerfield House Care Home Ltd's products / services
• Providing and managing your health and social care needs
• Conducting business, developing relationships with the Westerfield House Care Ltd and affiliates
o Process payments / transactions including: Accounting, Authorisation, Clearing, chargebacks, auditing, billing, reconciliation, collection, complaints, enquiries, credit checks and related dispute resolution activities
• Protect against and prevent fraud, unauthorised transactions, money laundering (please see below), tax evasion, claims, other liabilities and manage risk exposure and agent /franchise quality, integrity, compliance and security of business processes
• Provide, administer and communicate with you about the Westerfield House Care Ltd’s products, services, offers, programs and promotions, their issuers, acquirers, retailers and partners.
• Operate, monitor, evaluate and improve our products, services, websites, mobile applications, other digital assets and business.
o Developing new products and services
o Managing communications, assess effectiveness and optimisation of advertising
o Functionality of our websites, mobile applications other digital assets
• Evaluate your interest in employment and contact you regarding possible employment opportunities
• Enforce the Westerfield House Care Ltd “Terms of Use”, other legal rights as may be required by applicable laws and regulations or requested by any judicial process or governmental agency having or claiming jurisdiction over the Westerfield House Care Ltd or its affiliates.
• Comply with industry standards and the Westerfield House Care Ltd policies
We process information relating to the above reasons/purposes. This information may include:
1. Personal details
2. Business activities of the person whose personal information we are processing
3. Goods and services provided
4. Financial details
5. Education details
6. Employment details
We also process sensitive classes of information that may include:
I. Offences and alleged offences
We process personal information about our:
1. Customers
2. Clients and employees
3. Complainants and enquirers
4. Suppliers
5. Advisers and other professional experts
6. Information we Share
We do not sell or otherwise disclose personal information we collect about you, except as described in this Privacy Notice or as indicated via the consent process at the time the data is collected. We share the information we collect with, but not limited to:
• NHS bodies, Social Care bodies, GPs. Department of Health, National and Local Government and other associated health and social care providers
• Vetted affiliates and partners for business facilitation to provide required services, such as health and social care management etc.
• Formally contracted service providers to perform services on our behalf:
o Hosting Datacentres, Infrastructure, Applications (Development / Support), Cloud Services (Software as a Service – SaaS, Platform as a Service – PaaS, Infrastructure as a Service – IaaS)
o Helpdesk, Call Centres etc.
We contractually require these service providers to safeguard the privacy and security of personal information they process on our behalf and authorise them to use or disclose the information only as necessary to perform services on our behalf or comply with legal requirements;
• Councils, health and care providers
• Other Law firms
• Additionally, we may share information about you, if required legally, to prevent harm or financial / reputation loss, for investigation of suspected or actual fraudulent or illegal activities
• Perspective employers requesting references via your written consent
On websites, features can be accessed where we partner with other entities that are not affiliated with the Westerfield House Care Ltd. These include social networking, geo-location tools etc. are operated by third parties (indicated appropriately) who may use or share personal information in accordance with their own privacy policies. It is recommended that you review the third parties’ privacy policies if you use the relevant features.
The Westerfield House Care Ltd reserve the right to transfer your information in the event of a sale or transfer (wholly or partially) of our business or assets, with reasonable efforts for the acquirer protect / use your information consistent with our Global Privacy Notice. You can exercise your rights to contact the acquiring entity with questions concerning the protection and processing of your information.
7. Rights of the Data Subject
GDPR affords EU Data Subjects with rights. These rights are summarised below. In order to assert any of these rights, the Data Subject may contact the Data Protection Officer designated by Westerfield House Care ltd or another employee at any time.
The right of Confirmation: Each data subject shall have the right to obtain from the controller the confirmation as to whether or not personal data concerning him or her are being processed.
The right of Access: Each data subject shall have the right to obtain from the controller, free information about his or her personal data stored at any time and a copy of this information. Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.
Right to Rectification: Each data subject shall have the right granted by the European legislator to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Considering the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to Erasure (Right to be forgotten): Each data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have an obligation to erase personal data without undue delay where one of the statutory grounds applies, as long as the processing is not necessary
Right of Restriction of Processing: Each data subject shall have the right granted by the European legislator to obtain from the controller restriction of processing where a statutory reason applies
Right to Data Portability: Each data subject shall have the right granted by the European legislator, to receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format.
Right to Object: Each data subject shall have the right to object, on grounds relating to his or her particular situation, at any time, to the processing of personal data concerning him or her.
Automated individual decision-making, including profiling: Each data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling.
Right to Withdraw Consent: Where consent forms the basis for processing, Data Subjects shall have the right to withdraw his or her consent to the processing of his or her personal data at any time. Data Subjects can withdraw consent by logging into the user portal, clicking the privacy link in the menu and then updating the privacy settings as required. Data Subjects can also contact the Data Protection Officer or any other employee to withdraw consent.
8. Legal Basis for Processing
The Westerfield House Care Ltd processes your information under the following:
Consent: where we process information under consent we will seek your clear and unambiguous consent prior to processing your data; this will relate predominantly to information capture for health and social care purposes
Performance of a contract: where you enter into a contract with the Westerfield House Care Ltd and we need to process your information as part of this contract
Legitimate interests: some information is processed by the Westerfield House Care Ltd as part of its legitimate interests which include: Employment including hiring and recruitment, fraud, risk assessment, due diligence, network and information security, suppressions and managing opting out of communications, profiling, direct marketing, monitoring, web analytics, cloud storage, acquisitions, updating customer details, and other core products and service provided by the data controller
Public interest: some information is processed in accordance public interest such as investigations, wider public health needs and monitoring
Compliance with Legal Obligations: some information is processed in order for Westerfield House Care Ltd to meet its own legal obligations and when sharing is required under legal obligations of third parties such as NHS, Social Care and Police services
Vital interests: some information will be processed when this is in the vital interests of data subjects
9. Security of Processing
As the Controller, Westerfield House Care Ltd has implemented technical and organisational measures to ensure personal data processed remains secure however absolute security cannot be guaranteed. Should a Data Subject have a particular concern about a particular method of data transmission, we will take reasonable steps to provide an alternative method.
10. How long do we keep your Personal Information?
We will keep information for a reasonable amount of time in order to perform the purposes listed above.
We only keep your information for as long as necessary. We generally keep personal information for 6 years after last contact with you. However, the Westerfield House Care Ltd reserves the right to keep information for longer if we feel that this is in the legitimate interests of the Westerfield House Care Ltd.
In relation to employees we will keep your information for a minimum of 6 years after you cease employment with us but may keep all or part of this information for longer if required for references, legal requirements, or if in the legitimate interests of the Westerfield House Care Ltd.
In relation to perspective or potential employees we will keep your information for a minimum of 1 year before you take up employment with us and then for a minimum of 6 years as indicated in the previous section
In relation to unsuccessful employees we will retain your information for 1 year unless we are legally obliged to retain this for longer
11. Profiling
For the purposes of business conduct, enhancement, identification of fraud, money laundering and other potential unauthorised activities, the Westerfield House Care Ltd engages profiling activities via direct use or anonymisation of sensitive personal information.
12. Direct Profiling
Direct profiling is engaged for the fair and lawful purposes, to provide the Westerfield House Care Ltd the ability to enforce the Westerfield House Care Ltd “Terms of Use”, legal reporting as may be required by applicable laws, regulations, policies / standards or requested by any judicial process or governmental agency having or claiming jurisdiction over the Westerfield House Care Ltd or its affiliates; including, but not limited to:
• Benchmarking employees: appraisals, performance, bonus payments, disciplinary actions, improvement plans, promotions and awards
• Background checks for existing and new employees, clients, business partners, affiliates
• Financial viability analysis / reports
• Business partner / client portfolio position, performance, risk positions
• Anti-money laundering
• Tax reporting
• Credit defaulting /exposure
13. Indirect Profiling
Indirect profiling via anonymisation of personal information is also used for preparing and furnishing aggregated data reports showing anonymised information, including, but not limited to, the following:
• Compilations, analyses, analytical and predictive models and rules, and other aggregated reports for the purpose of advising our partners / affiliates and servicing institutions, retailers and other customers regarding past and potential future patterns of service usage, spending, fraud, and other insights that may be extracted from this data.
• Compiling and communicating promotional and marketing information about products and services that the Westerfield House Care Ltd, affiliates and other organisations that we have affiliations with have and that may be of interest to you.
• Conducting market research
• Facilitating our internal business operations, including the fulfilment of any legal requirements.
14. How to Contact Us / Complaints and Feedback
If you:
• make a complaint about a breach of your personal information, applicable privacy laws / principles or a concern about Westerfield House Care Ltd privacy practices
• would like access and/or update information or preferences you provided to us
You also may email us at: admin@westerfieldhouse.co.uk
Or write to us at:
Westerfield House Care Ltd
Humber Doucy Lane
Ipswich, Suffolk
IP4 3QG.
If we fall short of your expectations in processing your personal information or you wish to make a complaint about our privacy practices, please contact us via admin@westderfieldhouse.co.uk or write to us at the above address.
To assist us in responding to your request, please give full details of the issue. We attempt to review and respond to all complaints within a reasonable time.
If we cannot for lawful reasons complete your request we will explain this to you to the extent that we lawfully can.
15. Changes to this notice
We will update this statement from time to time so we suggest that you review this statement at regular intervals. Where we undergo substantial changes to our privacy statement we will endeavour to inform you directly about these changes.
10th October 2018
