1. Introduction and Legal Framework

When Cinnamon Care Collection processes your personal data, it is required to comply with laws and regulations governing the processing of personal data (referred to as “Data Protection Legislation”).

Your personal data is all the information we hold relating to you as an identified or identifiable natural person (for example, your name, postal address, date of birth; as well as more sensitive types of data, including medical and health records, and information about your religious beliefs, ethnic origin and race, and sexual orientation).

Processing your personal data covers most things we do with it, including collecting, storing, amending, transferring and deleting it.

This privacy notice provides information about the personal data we process, why we process it, and how we process it.

2. Who We Are

Cinnamon Care Collection is the brand name used by a number of Care Homes and Retirement Villages run by different companies within the same corporate group. When this privacy notice refers to Cinnamon Care Collection, it means the company that runs a particular Care Home or Retirement Village, which is the data controller in respect of your personal data.

Cinnamon Care Collection Limited (company number 10057697) provides data protection support to all companies within the Cinnamon Care Collection Group and provides the senior person with overall data protection responsibility for each of them, including day-to-day oversight of requests from individuals exercising data protection rights (known as the Senior Responsible Individual).

You can contact the Senior Responsible Individual, or obtain details of the company that runs a particular Care Home or Retirement Village and is the data controller for it, by writing to Cinnamon Care Collection Limited at:

Cinnamon Care Collection Limited 24 Adam & Eve Mews Kensington London W8 6UJ

Or by email to: dpo@cinnamoncc.com

3. What Personal Data Do We Process About You?

We process your personal data in order to provide you with the services you have requested, to meet our legal obligations, to enter into a contract with you and/or to provide you with all the information you need. We may also process your personal data to respond to any queries or comments you submit to us. Our Website Privacy Statement and Cookies Policy cover how we process your personal data when you visit our website.

The categories of personal data we process, together with the purpose and lawful basis for each, are set out below.

3.1 All Individuals (including enquirers, visitors, residents and their families)

Data Category	Purpose	Lawful Basis
CCTV recordings	Safety of residents, workers and visitors; prevention and detection of crime	Legitimate interests (including Recognised Legitimate Interests under Schedule 2, DUAA 2025)
Call recordings	Training and quality assurance	Legitimate interests
Identity data (first name, middle names, last name, title, date of birth, sex, marital status)	Responding to care service enquiries; day-to-day correspondence	Performance of a contract / Legitimate interests
Contact data (address, email address, telephone numbers)	Responding to care service enquiries; day-to-day correspondence	Performance of a contract / Legitimate interests

3.2 Residents

Data Category	Purpose	Lawful Basis
Identity data (first name, middle names, last name, title, date of birth, sex, marital status)	Provision of care services; regulatory compliance	Performance of a contract; Legal obligation
Contact data (address, email address, telephone numbers)	Provision of care services; day-to-day correspondence	Performance of a contract
Financial data (bank account and payment card details)	Billing and fee collection	Performance of a contract; Legal obligation
Special categories of data (health and medical records)	Provision of health and social care; care planning and management	Article 9(2)(h) UK GDPR (health and social care provision); Schedule 3, DPA 2018
Special categories of data (diversity and equality information (race, ethnicity, religious beliefs, sexual orientation))	Equality monitoring; personalisation of care	Explicit consent (Article 9(2)(a) UK GDPR); Article 9(2)(h) where relevant to care
Photographs	Care records; identification	Article 9(2)(h) UK GDPR (health and social care provision); Explicit consent (if used for marketing purposes)

3.3 Relatives, Next of Kin, Attorneys and Deputies of a Resident

Data Category	Purpose	Lawful Basis
Identity data (first name, middle names, last name, title, date of birth, sex, marital status)	Correspondence and contact in connection with a resident’s care	Legitimate interests; Legal obligation
Contact data (address, email address, telephone numbers)	Emergency contact; correspondence relating to a resident’s welfare	Legitimate interests; Vital interests of the resident

3.4 Care Home Visitors

Data Category	Purpose	Lawful Basis
Identity data (first name, last name)	Site security and safety management	Legitimate interests (including Recognised Legitimate Interests)
Purpose of visit	Site security and safeguarding	Legitimate interests
Car registration details	Car park management and site security	Legitimate interests

4. Lawful Bases for Processing

We process your personal data on one or more of the following lawful bases, depending on the nature and purpose of the processing:

• Consent (Article 6(1)(a) UK GDPR): where you have given us clear, informed and specific agreement to do so. If we obtain your consent, you can withdraw it at any time by contacting our Senior Responsible Individual. Withdrawing your consent will not affect the lawfulness of any processing we carried out before you withdrew it.
• Performance of a contract (Article 6(1)(b) UK GDPR): where processing is necessary to provide services to you, or to take steps at your request prior to entering into a contract.
• Legal obligation (Article 6(1)(c) UK GDPR): where we are required to process your data to comply with a legal obligation to which we are subject.
• Vital interests (Article 6(1)(d) UK GDPR): where processing is necessary to protect the life of you or another person.
• Legitimate interests (Article 6(1)(f) UK GDPR): where we have a legitimate interest in processing your data that is not overridden by your interests, rights or freedoms. This includes interests that are Recognised Legitimate Interests under Schedule 2 of the Data Use and Access Act 2025 (such as safeguarding, the prevention and detection of crime, and the protection of public safety) which do not require a separate balancing assessment. Where we rely on other legitimate interests, we can provide further information about the nature of those interests on request.

For special categories of personal data (such as health and medical information), we rely on the additional conditions in Article 9(2) UK GDPR, principally:

• Article 9(2)(h): processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services;
• Article 9(2)(a): explicit consent, where applicable; and
• Article 9(2)(g): reasons of substantial public interest, in accordance with Schedule 1, DPA 2018.

5. Who Will Receive Your Personal Data?

We only transfer your personal data to the extent necessary for the relevant purpose. Recipients of your personal data may include:

• External medical and healthcare providers such as your GP, hospital staff, dentists and other care providers
• Safeguarding authorities, commissioning bodies and Integrated Care Boards (ICBs)
• Regulators, including the Care Quality Commission (CQC) and the Information Commission
• The police and other law enforcement agencies
• IT service providers and payment processing providers
• Attorneys, deputies and legal representatives
• Auditors and professional advisers (including solicitors and insurers)

6. International Transfers of Personal Data

Wherever possible, we ensure that personal data remains within the United Kingdom or the European Economic Area (EEA). Where data is transferred internationally, we ensure that appropriate safeguards are in place. These may include:

• Transfers to countries that benefit from a UK adequacy decision;
• Use of International Data Transfer Agreements or other approved transfer mechanisms; or
• Binding Corporate Rules, where applicable.

You can request further information about the specific safeguards we use for any particular international transfer by contacting our Senior Responsible Individual at the address set out in section 2.

7. How Long Will We Keep Your Personal Data?

We will only keep your personal data for as long as is necessary to fulfil the purposes for which we collected it, including satisfying any legal, contractual or reporting requirements. Your information will be kept securely at all times.

Following the end of the relevant retention period, your personal data will be permanently and securely deleted or destroyed.

8. Children’s Data

We may process personal data about children in the context of care home visits or where a child is named as a family member of a resident. Where we do so, we take additional care to ensure that processing is proportionate, limited to what is strictly necessary, and that appropriate safeguards are in place.

We do not knowingly use children’s personal data for any purpose other than that for which it was collected. If you believe we have collected personal data about a child inappropriately, please contact our Senior Responsible Individual immediately using the contact details in section 2.

9. Your Rights

You benefit from a number of rights in respect of the personal data we hold about you. These rights apply for the period in which we process your data. More information is available from the Information Commission’s website at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.

9.1 Right of Access

You have the right to ask us to confirm whether we process your personal data, and to request access to, or copies of, your personal data together with certain information about how and why we process it (much of which is set out in this notice).

We will provide the information free of charge unless your request is vexatious or excessive, or repetitive, in which case we are entitled to charge a reasonable fee or, in some circumstances, to decline to comply. We will explain our reasons to you if we consider your request falls within this category.

We will respond to your request as soon as reasonably practicable and in any event within one month of receiving it. Where your request is complex or you have made a number of requests, we may extend this period by a further two months (to a maximum of three months in total). We will notify you within the initial one-month period if we need additional time and will explain why.

9.2 Right to Rectification

If you believe personal data we hold about you is inaccurate or incomplete, you can ask us to correct or complete it. We will comply with your request within one month of receiving it. We will let you know if we do not consider rectification appropriate in your case, or if we need more time to comply.

9.3 Right to Erasure (Right to be Forgotten)

In some circumstances, you have the right to ask us to delete personal data we hold about you. This right is available to you where:

• We no longer need your personal data for the purpose for which we collected it;
• We have processed your personal data on the basis of your consent and you withdraw that consent;
• You object to the processing and we have no overriding legitimate interests to continue;
• We have processed your personal data unlawfully; or
• The personal data must be deleted to comply with a legal obligation.

There are certain circumstances in which we are entitled to refuse a request for erasure (for example, where we must retain records to comply with a legal obligation or for the establishment, exercise or defence of legal claims). We will inform you if any such exception applies.

9.4 Right to Restrict Processing

In some circumstances, you are entitled to ask us to restrict our processing of your personal data. This means we will stop actively processing it, but we are not required to delete it. This right is available to you where:

• You believe the personal data we hold is inaccurate (we will cease processing it until we have verified its accuracy);
• You have objected to our processing (we will cease processing it whilst we determine whether our legitimate interests override your objection);
• The processing is unlawful but you do not wish us to delete the data; or
• We no longer need the data, but you require it to establish, exercise or defend a legal claim.

9.5 Right to Data Portability

You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit it to another data controller. This right applies only where:

• Processing is based on your consent or for the performance of a contract; and
• We carry out the processing by automated means.

We will respond to your request as soon as reasonably practicable and in any event within one month from the date we receive it. We will notify you if we need additional time.

9.6 Right to Object

You are entitled to object to us processing your personal data where:

• The processing is based on legitimate interests or the performance of a task in the public interest or the exercise of official authority;
• The processing is for direct marketing purposes (including profiling); or
• The processing is for the purposes of scientific or historical research or statistics.

Where you object, you must provide grounds based on your particular situation (except in the case of direct marketing, where no grounds are required). Where you raise an objection, we will cease processing as soon as reasonably practicable whilst we assess your objection. We will only resume or continue processing if we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

9.7 Automated Decision-Making

Automated decision-making means making a decision solely by automated means without any meaningful human involvement.

We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may, however, use automated tools (such as digital care planning or risk assessment systems) to support our decision-making. Where we do so, a human being will always be meaningfully involved in the final decision.

Should this position change, we will update this notice accordingly and, where required by the Data Protection Legislation, provide you with the opportunity to request human review of any automated decision or to contest it.

10. Your Right to Complain

If you think we have processed your personal data unlawfully, or that we have not complied with our obligations under the Data Protection Legislation, you have the right to report your concerns to the supervisory authority.

The supervisory authority in the UK is the Information Commission:

• Telephone: 0303 123 1113
• Website: https://ico.org.uk/concerns/
• Post: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You also have the right to bring a claim before the courts if you consider that we have infringed your data protection rights.

We would, however, welcome the opportunity to address any concerns you may have directly before you contact the Information Commission. Please feel free to contact our Senior Responsible Individual in the first instance using the details in section 2.

11. Changes to This Privacy Notice

We reserve the right to update this privacy notice at any time. Where we make any change to this notice which materially affects your rights and freedoms in respect of your personal data, we will notify you.

12. Any Questions?

If you have any questions about this privacy notice or would like more information about the ways in which we process your personal data, please contact our Senior Responsible Individual at:

Email: dpo@cinnamoncc.com

Post: Cinnamon Care Collection Limited, 24 Adam & Eve Mews Kensington London W8 6UJ