1. Who we are

Sunrise Homes Services Ltd is the data controller responsible for your personal information.

2. The personal information we collect

We collect different information depending on who you are and how you interact with us:

a) Young people referred to, or living in, our supported accommodation

This is the most sensitive category of information we hold, and includes:

• Name, date of birth, contact details and next of kin / emergency contacts
• Care history, placement and referral information, and local authority / social worker details
• Health information, including physical and mental health, medication and any additional support needs
• Safeguarding information, risk assessments, and behaviour or incident records
• Education, training and employment information
• Financial information relevant to benefits, rent or personal allowances
• CCTV images at our premises, where applicable

Health, safeguarding and similar details are "special category data" under UK GDPR and are handled with extra care, as explained in Section 5.

b) Referring professionals, local authorities and social workers

• Name, job title, organisation and contact details
• Information you share with us as part of a referral or ongoing case management, including information about the young person

c) Job applicants and staff

• Name, contact details, CV, employment history and references
• Right-to-work, DBS and safeguarding checks
• Training records, supervision notes and performance information
• Payroll, tax and bank details, where you are employed by us

d) Website visitors and general enquiries

Our website does not include an enquiry form. If you contact us, we only collect what you send us directly by email or telephone (for example, your name, contact details and the content of your message).

3. How we collect your information

We collect personal information:

• Directly from you, a parent/guardian, or your representative, by email or telephone
• From referring local authorities, social workers or other professionals involved in your care
• From other agencies involved in your support, such as healthcare professionals, education providers, the police or Ofsted
• From job applicants and staff directly, and from references or background-check providers

4. Why we use your information, and our legal basis

We only use personal information where we have a valid legal basis to do so under UK GDPR.

Purpose / Activity	Legal Basis	Why
Providing supported accommodation and care planning for young people	Performance of a contract with a local authority or commissioner, and our legal obligation to deliver regulated care safely	So we can plan, deliver and record the support we provide
Safeguarding and protecting the welfare of young people	Legal obligation, and vital interests where there is a risk to someone's safety	To keep young people, staff and visitors safe
Liaising with local authorities, social workers and other agencies	Legal obligation and legitimate interests in coordinating care	So everyone involved in a young person's care has the information they need
Recruiting and managing staff	Performance of a contract of employment and legal obligation	So we can run our organisation and meet employment law requirements
Responding to general enquiries	Legitimate interests in responding to people who contact us	To answer your questions
Regulatory compliance and inspection (e.g. Ofsted)	Legal obligation	Because we are a regulated provider of supported accommodation

Where we rely on "legitimate interests", we have considered that our use of the information is reasonable, proportionate, and does not unfairly override your own interests or rights.

5. Special category and safeguarding data

Health, safeguarding and similar sensitive information about young people in our care is "special category data". We only process this where an additional condition under Article 9 UK GDPR applies, which will usually be:

• Provision of health or social care, or treatment, under our contract with a local authority (Article 9(2)(h))
• Protecting someone's vital interests where they are unable to give consent, in an emergency (Article 9(2)(c))
• Reasons of substantial public interest, for safeguarding purposes (Article 9(2)(g), read with Schedule 1 of the Data Protection Act 2018)

Access to this information is restricted to staff and agencies who need it to support the young person, and is held securely as described in Section 8.

6. Who we share your information with

We share personal information, where necessary and lawful, with:

• Local authorities, commissioners and social workers responsible for a young person's placement
• Ofsted and other regulators, for inspection and compliance purposes
• Healthcare professionals and services (e.g. GPs, mental health services), where relevant to a young person's care
• The police and other safeguarding partners, where there is a safeguarding concern or legal duty to share
• Our professional advisers (e.g. accountants, insurers) and IT or software providers who support our systems, under confidentiality obligations
• Regulatory or law enforcement bodies, where we are required to do so by law

We do not sell personal information, and we do not share information with third parties for their own marketing purposes.

7. International transfers

We store and process personal information within the United Kingdom. If this changes, and we need to transfer information outside the UK, we will only do so with appropriate safeguards in place and will update this notice accordingly.

8. How we keep your information secure

We use appropriate technical and organisational measures to protect personal information, including restricted access to records on a need-to-know basis, secure storage of paper and electronic files, staff training on confidentiality and safeguarding, and secure disposal of records at the end of their retention period.

9. How long we keep your information

We keep personal information only for as long as necessary for the purposes it was collected, and to meet our legal, regulatory and contractual obligations. As a supported accommodation provider, some of our retention periods are set by statutory guidance and local authority contracts rather than by us.

Type of record	Retention period	Why
Young people's care and support records	Typically retained until the young person's 75th birthday (in line with common children's social care retention guidance), unless a shorter period is specified by the placing local authority or Ofsted	Statutory/regulatory requirement, and to support the young person in later life if records are needed
Safeguarding records	As above, or as directed by the relevant local safeguarding partnership	To support any future safeguarding enquiries
Staff recruitment and employment records	Generally 6 years after employment ends (unemployed applicants: up to 6 months)	Employment law and limitation periods for legal claims
DBS check outcomes	As required by DBS Code of Practice (typically no longer than 6 months, with a record that a check was done kept longer)	DBS guidance
General correspondence / enquiries	Up to 2 years	Legitimate business record-keeping
Financial and payroll records	6 years	HMRC and statutory requirements

10. Cookies and website analytics

Our website is primarily informational and does not include an enquiry form; if you wish to contact us, you do so by email or telephone. Our website does not use cookies or analytics software, and no personal information is automatically collected from you simply by browsing the site.

11. Your rights

Under UK data protection law, you (or, where relevant, your parent/guardian or advocate acting on your behalf) have the right to:

• Be informed about how your personal information is used
• Access the personal information we hold about you
• Request that inaccurate information be corrected
• Request erasure of your information in certain circumstances
• Restrict or object to certain processing
• Request that information be transferred to you or another organisation, where relevant
• Withdraw consent, where we rely on consent as our legal basis

To exercise any of these rights, please contact us using the details in Section 1. We may need to verify your identity, and some rights are subject to exemptions, particularly where releasing information could put a young person's safety, or someone else's, at risk.

12. Young people and this notice

Because we support young people, we aim to explain how we use personal information in a clear and age-appropriate way, and to involve young people in decisions about their information wherever it is safe and appropriate to do so, alongside their social worker, local authority or advocate.

13. Complaints

If you have a concern about how we handle personal information, please contact us first so we can try to resolve it. You also have the right to complain to the UK's data protection regulator:

14. Changes to this notice

We may update this notice from time to time, for example to reflect changes in our services or the law. The "last updated" date at the top of this notice shows when it was last revised. We encourage you to check it periodically.

15. Contact us

If you have any questions about this notice or how we handle personal information, please contact: