Version: 2.0 

Approved by: Board of Trustees 

Policy Owner: Chief Executive 

Review Frequency: Every two years or sooner if required by changes in legislation  or organisational practice. 

Last Reviewed: July 2026 

Purpose 

St John’s Winchester (“the Charity”, “we”, “our” or “us”) is committed to protecting  the privacy and security of the personal information we collect. 

We recognise that the people we work with place their trust in us and we take our  responsibilities under the UK General Data Protection Regulation (UK GDPR), the  Data Protection Act 2018 and other applicable legislation seriously. 

This Privacy Notice explains how we collect, use, store and protect personal  information when you engage with the Charity. 

Who We Are 

St John’s Winchester is a registered charity providing: 

• Almshouse accommodation 
• Resident wellbeing and community support 
• Dementia Support Services 
• Volunteer services 
• Community activities 
• Property and estate management 

We act as the Data Controller for the personal information described in this notice. 

Contact Details 

If you have any questions regarding this Privacy Notice or wish to exercise your  rights, please contact: 

Data Protection Lead 

St John’s Winchester 

32 St John’s South 

The Broadway

Winchester 

SO23 9LN 

Email: privacy@stjohnswinchester.co.uk 

Telephone: 01962 854226 

Information We Collect 

The information we collect depends on how you interact with us. 

This may include: 

Identity Information 

• Name 
• Date of birth 
• Address 
• Telephone numbers 
• Email address 
• Emergency contacts 

Financial Information 

• Bank account details 
• Payment records 
• Gift Aid information 

Resident Information 

• Housing applications 
• Occupancy information 
• Support requirements 
• Welfare contacts 
• Maintenance records 

Dementia Support Information 

Where appropriate, we may collect: 

• Health information 
• Dementia diagnosis 
• Care needs 
• Assessments 
• Support plans 
• Information provided by health professionals 
• Information from carers and family members 

Volunteer Information 

• Contact details
• References 
• DBS information where required 
• Training records 
• Availability 

Employment Information 

For employees and job applicants we may collect: 

• Employment history 
• Qualifications 
• References 
• Payroll information 
• Right to work documentation 
• DBS checks where required 

Website Information 

When you visit our website we may collect: 

• IP address 
• Browser type 
• Device information 
• Cookie information 
• Website usage information 

How We Collect Information 

We obtain information: 

• Directly from you 
• From application forms 
• During assessments 
• Through meetings and correspondence 
• Through our website 
• From healthcare professionals 
• From local authorities 
• From NHS organisations 
• From Dementia UK 
• From family members or representatives where appropriate 
• From volunteers 
• From regulatory bodies where required by law

Why We Process Your Information 

We process personal information in order to: 

• Assess applications for almshouse accommodation 
• Manage residency and licences 
• Deliver wellbeing services 
• Deliver Dementia Support Services 
• Safeguard residents and service users 
• Respond to emergencies 
• Maintain accurate records 
• Recruit and manage staff 
• Recruit and support volunteers 
• Process donations 
• Manage contracts 
• Meet legal obligations 
• Improve our services 
• Protect our residents, staff and property 

Our Lawful Basis for Processing 

Under UK GDPR we process information under one or more of the following lawful  bases: 

• Consent 
• Performance of a contract 
• Compliance with a legal obligation 
• Protection of vital interests 
• Performance of a task carried out in the public interest 
• Legitimate interests pursued by the Charity 

Where we process health or other special category information, we rely upon the  relevant conditions under Article 9 UK GDPR and Schedule 1 of the Data Protection  Act 2018. 

Special Category Information 

Some of the services we provide require us to process information about:

• Mental health 
• Physical health
• Dementia 
• Disabilities 
• Safeguarding concerns 
• Social care needs

We only process this information where there is a lawful basis to do so and where  appropriate safeguards are in place. 

Who We Share Information With 

We only share personal information where necessary and lawful. 

This may include: 

• NHS organisations 
• GP Practices 
• Hampshire County Council 
• Winchester City Council 
• Dementia UK 
• Emergency services 
• Professional advisers 
• Auditors 
• Regulators 
• Our IT service providers 
• Payment processors 
• Contractors carrying out services on our behalf 

We never sell personal information. 

Systems We Use 

To deliver our services securely we use a range of trusted systems, which may  include: 

• Microsoft 365 
• Salesforce CRM 
• Financial management systems 
• Property management systems 
• Secure cloud storage 
• Website hosting providers 

All suppliers are required to meet appropriate data protection standards. 

International Transfers 

Some of our service providers may process information outside the United Kingdom. 

Where this occurs, appropriate safeguards are implemented to ensure that personal  information remains protected in accordance with UK GDPR. 

Data Security 

We employ appropriate technical and organisational measures including: 

• Secure IT systems 
• Encryption where appropriate 
• Access controls 
• Password management 
• Multi-factor authentication 
• Staff training 
• Confidentiality obligations 
• Secure disposal of records 
• Regular review of security arrangements 

How Long We Keep Information 

We only retain information for as long as necessary. 

Retention periods are determined by: 

• Legal requirements 
• Regulatory guidance 
• Operational needs 
• Charity Commission expectations 
• Limitation periods 

Full details are contained within the St John’s Winchester Data Retention Schedule. When information is no longer required it is securely deleted or destroyed. Your Rights 

You have the right to: 

• Access your personal information 
• Correct inaccurate information 
• Request erasure where appropriate 
• Restrict processing 
• Object to processing 
• Receive a copy of your information where applicable 
• Withdraw consent where consent is relied upon 

Some rights may be limited where legal exemptions apply. 

Cookies 

Our website uses cookies to ensure the website functions correctly and to help us  understand how visitors use the site. 

Where required, we will ask for your consent before placing non-essential cookies on  your device. 

Further details are available in our Cookie Notice. 

Marketing 

We will only send marketing or fundraising communications where we have an  appropriate lawful basis.

You may unsubscribe or update your preferences at any time. 

Children’s Information 

Although our services are primarily aimed at older people, we may occasionally  process information relating to children or young people where they are family  members, volunteers or participants in community activities. 

Such information is processed with appropriate safeguards. 

CCTV 

Where CCTV operates at our premises, it is used to: 

• Protect residents 
• Protect staff 
• Prevent crime 
• Investigate incidents 
• Protect Charity property 

Separate signage is displayed where CCTV is in operation. 

Automated Decision Making 

St John’s Winchester does not make decisions about individuals solely by automated  means. 

Complaints 

If you are unhappy with how we use your information, please contact us first so that  we can try to resolve your concerns. 

You also have the right to complain to the Information Commissioner’s Office (ICO). 

Changes to this Privacy Notice 

We may update this Privacy Notice from time to time. 

The latest version will always be available on our website and significant changes  will be communicated where appropriate.