Privacy Notice for Relatives of Residents or Prospective Residents
1. Who We Are and What This Notice Covers
This Privacy Notice explains how we collect, use, and protect personal information about relatives, friends, and carers of our residents.
We are the data controller for the personal data described in this notice. This means we are responsible for deciding how and why your personal information is used, and for keeping it safe.
This notice specifically covers how we use your contact details to send you information about events, news, and offers relating to our home and services. It does not cover how we process the personal data of residents themselves (which is covered by a separate Resident Privacy Notice).
Our contact details are:
Data Controller: Cedar Care Homes
Address: Mortimer House, Clifton Down Road, Bristol, BS8 4AE
Email: [email protected]
Telephone: 0117 946 7216
Data Protection Officer: Shyam Desai-Putterhill (email as above)
We are registered with the Information Commissioner’s Office (ICO).
2. What Personal Data We Collect About You
We collect and hold the following categories of personal data about you:
- Identity and contact information: Your name, relationship to the resident (e.g., son, daughter, spouse), postal address, email address, and telephone number.
- Communication records: Records of our correspondence with you, including emails, letters, and notes of telephone calls.
- Event and interaction data: Information about your attendance at events we have hosted or your participation in activities relating to the home.
- Marketing preferences: Your preferences regarding receiving information about events and offers from us.
We collect this information directly from you when you provide your contact details to us, for example during the enquiry or admissions processes for a resident, when you attend an event, or when you sign up to receive updates from us.
3. How We Use Your Personal Data and Our Lawful Basis
We use your personal data for the following purposes. For each purpose, we have identified the lawful basis under the UK GDPR that allows us to process your information.
Purpose of Processing | Lawful Basis |
To send you information about events, news, and offers relating to our home and services (marketing communications) | Consent — You have given us clear consent to use your personal data for this specific purpose (Article 6(1)(a) UK GDPR). |
To manage your marketing preferences and honour any opt-out requests | Legal Obligation — We are required to maintain suppression lists to comply with data protection law (Article 6(1)(c) UK GDPR). |
To communicate with you about the care of your resident relative where you are involved in their care or well-being | Legitimate Interests — It is in the legitimate interests of the resident, ourselves, and you to facilitate communication regarding the resident’s care (Article 6(1)(f) UK GDPR). |
To comply with our legal and regulatory obligations (e.g., to the Care Quality Commission or local authorities) | Legal Obligation — We are required to maintain suppression lists to comply with data protection law (Article 6(1)(c) UK GDPR) |
To communicate with you about the care of your resident relative where you are involved in their care or well-being | Legitimate Interests — It is in the legitimate interests of the resident, ourselves, and you to facilitate communication regarding the resident’s care (Article 6(1)(f) UK GDPR). |
To comply with our legal and regulatory obligations (e.g., to the Care Quality Commission or local authorities) | Legal Obligation (Article 6(1)(c) UK GDPR) |
Our Legitimate Interests: Where we rely on legitimate interests as our lawful basis, we have conducted a balancing test to ensure your rights and interests do not override ours. Our legitimate interest is in maintaining effective communication with the relatives of our residents, which helps us provide better care and maintain a supportive community.
Marketing Communications: We will only send you marketing communications (such as information about upcoming events or special offers) where you have given us your consent to do so. You have the right to withdraw this consent at any time.
4. Who We Share Your Personal Data With
We do not sell your personal data to any third parties.
We may share your personal data with the following categories of recipients:
- Service providers: We use trusted third-party service providers to help us communicate with you, including email marketing platforms and mailing houses. These providers act as data processors and are contractually bound to protect your data and only use it for the purposes we specify.
- Professional advisers: We may share data with our legal and insurance advisers where necessary to establish, exercise, or defend legal claims.
- Regulatory and statutory bodies: We may be required to share information with the Care Quality Commission (CQC), local authorities, or other regulators in the performance of their statutory functions.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
5. International Transfers
We do not transfer your personal data outside the United Kingdom.
6. How Long We Keep Your Personal Data
We will only retain your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements.
Retention periods:
Marketing preferences and consent records: Retained for 2 years after your last interaction with us, or until you withdraw consent.
Suppression lists: Retained indefinitely to ensure we continue to honour your opt-out preferences.
General correspondence: Retained for 3 years in line with our general business record retention policy.
When your data is no longer needed, we will securely delete or anonymise it.
7. Your Data Protection Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
Your Right | What it Means |
Right to be Informed | You have the right to know how we use your data, which is why we provide this notice. |
Right of Access | You can request a copy of the personal data we hold about you. |
Right to Rectification | You can ask us to correct any inaccurate or incomplete personal data. |
Right to Erasure | In certain circumstances, you can ask us to delete your personal data. |
Right to Restrict Processing | In certain circumstances, you can ask us to limit how we use your data. |
Right to Data Portability | You can ask us to transfer your data to another organisation, where technically feasible. |
Right to Object | You have the absolute right to object to direct marketing at any time. You also have the right to object to processing based on legitimate interests, unless we can demonstrate compelling legitimate grounds that override your interests. |
Right to Withdraw Consent | Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing. |
To exercise any of these rights, please contact us using the details in Section 1.
We will respond to your request within one month. We may need to verify your identity before processing your request.
8. How to Opt Out of Marketing Communications
You can ask us to stop sending you marketing communications at any time.
How to opt out:
- Click the “unsubscribe” link in any marketing email we send you.
- Email us at [email protected]
- Write to us at Cedar Care Homes, Mortimer House, Clifton Down Road, Bristol, BS8 4AE
- Call us on 0117 946 7216
Once you have opted out, we will add your details to a suppression list to ensure you do not receive further marketing communications from us. We will retain this suppression list to comply with your request.
Please note: Opting out of marketing communications will not prevent us from contacting you about matters directly related to the care of your resident relative, where you are involved in their care.
9. How to Complain
If you have any concerns about how we have used your personal data, please contact us first using the details in Section 1 so we can try to resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes where required.
This Privacy Notice is provided in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
September 2026