Privacy Policy

Last updated: 26 May 2026

1. About this policy

This Privacy Policy explains how the SLS group collects, uses, stores, and shares your personal data when you visit our website, contact us, or use our services. The SLS group is made up of two connected but distinct legal entities, each acting as a separate data controller under UK GDPR for the activities it carries out:

• Supported Living Services Ltd — a company registered in England & Wales (Company No. 10359397). Registered office: 49 Waddington Road, London, E15 1QL. Regulated by the Care Quality Commission (CQC), Provider ID 1-9711750185. Registered with the Information Commissioner's Office (registration number available on request). Acts as data controller for care, support, recruitment, and general business activities.
• SLS Housing Association — a charitable Community Benefit Society registered under the Co-operative and Community Benefit Societies Act 2014, FCA Mutuals Public Register No. 9778. Registered office: 49 Waddington Road, London, E15 1QL. Registered with the Information Commissioner's Office (registration number available on request). Acts as data controller for tenancy management, repairs, rent and service charge, and landlord activities.

Where personal data is processed jointly (for example, where care planning and accommodation are arranged together for the same resident), the two entities act as joint controllers and have an arrangement in place describing their respective responsibilities. A summary of that arrangement is available on request.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data: name, date of birth, gender, photographs (with consent).
• Contact data: postal address, email, telephone number, next-of-kin details.
• Technical data: IP address, browser type, device type, cookie identifiers.
• Usage data: pages visited, time on site, referral source.
• Communication data: messages sent through contact, referral, feedback, survey and recruitment forms.
• Tenancy data: tenancy or licence agreement, rent and service-charge records, repair reports, anti-social behaviour reports, neighbourhood-related correspondence.
• Special-category data: information about your health, mental-health needs, disabilities, ethnicity, sexual orientation or religious beliefs — only where you (or someone authorised to act on your behalf) have provided it as part of a referral, care plan, safeguarding concern or reasonable-adjustment request.
• Criminal-offence data: only where lawfully necessary, for example during recruitment (DBS checks) or where a forensic-history risk assessment is part of a care referral.

3. Why we use your data and the lawful bases we rely on

Under UK GDPR we must have a lawful basis for every use of your personal data. Where we process special-category data we also rely on an Article 9 condition. The table below sets out our principal processing activities. For more detail about any item, please contact us using the details in section 11.

3.1 Responding to enquiries and referrals

When you contact us through the website, by phone or by email, or when a professional makes a referral on your behalf, we process your data to assess the enquiry and respond.

• Controller: Supported Living Services Ltd.
• Article 6 basis: taking steps to enter into a contract (Art 6(1)(b)) where you are the prospective service user; legitimate interests (Art 6(1)(f)) where the contact is on someone else's behalf.
• Article 9 condition (where health data is shared): provision of health or social care under Art 9(2)(h), under the conditions and safeguards of Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018.

3.2 Providing care and support

Once a care package is in place, we process your data to plan and deliver your care, manage medication, record incidents, support safeguarding decisions, and report to commissioners where required.

• Controller: Supported Living Services Ltd.
• Article 6 basis: performance of a contract (Art 6(1)(b)); legal obligation under the Health and Social Care Act 2008 and the Care Act 2014 (Art 6(1)(c)); legitimate interests for incident records (Art 6(1)(f)).
• Article 9 condition: Art 9(2)(h) — provision of health or social care.

3.3 Providing accommodation, managing tenancies and repairs

We process tenancy and licence data to allocate accommodation, collect rent, carry out repairs, manage anti-social behaviour, and comply with our duties as a landlord.

• Controller: SLS Housing Association.
• Article 6 basis: performance of a tenancy or licence contract (Art 6(1)(b)); legal obligation under housing and consumer-protection legislation (Art 6(1)(c)); legitimate interests for safeguarding and neighbourhood management (Art 6(1)(f)).
• Article 9 condition (where relevant): Art 9(2)(h) for care-related coordination; Art 9(2)(g) (substantial public interest — safeguarding, equality of opportunity) under Schedule 1 of the DPA 2018.

3.4 Marketing, newsletters and surveys

Where you have opted in, we may send you newsletters and ask you to take part in feedback surveys.

• Controller: Supported Living Services Ltd (for general newsletters); SLS Housing Association (for tenancy-related satisfaction surveys).
• Article 6 basis: consent (Art 6(1)(a)). You can withdraw consent at any time using the unsubscribe link or by emailing us.

3.5 Recruitment

When you apply for a role we process the information you provide, along with results from right-to-work, reference and DBS checks where the role requires them.

• Controller: Supported Living Services Ltd.
• Article 6 basis: taking steps to enter into a contract (Art 6(1)(b)); legal obligation in relation to immigration and safer-recruitment checks (Art 6(1)(c)).
• Article 10 (criminal-offence data): processing carried out under the substantial-public-interest condition for safeguarding of children and of individuals at risk (DPA 2018 Schedule 1 Part 2 paragraph 18).

3.6 Website analytics

With your consent, we use analytics cookies to understand how visitors use the website. See our Cookie section below and the cookie banner.

• Controller: Supported Living Services Ltd (acting for both entities for site analytics).
• Article 6 basis: consent (Art 6(1)(a)).

4. Cookies

When you first visit the site we show a cookie banner. You can choose between three categories. Non-essential cookies are not set until you have given consent, and we treat “Accept all” and “Reject non-essential” with equal prominence. You can change or withdraw your choice at any time through the Cookie preferences link in the footer.

• Strictly necessary (always on): required for the website to function — for example, remembering your cookie choice.
• Analytics (consent required): help us understand how visitors use the website so we can improve it.
• Preferences (consent required): remember non-essential settings you choose on the site.

Your consent choice is stored locally in your browser under the key sls_cookie_prefs_v1. This is itself a strictly-necessary item that does not require consent.

At the date of this policy the only non-essential cookie technology in use is the strictly-necessary preference key above. If we introduce analytics or preference cookies in future, this section will be updated with the specific named cookies, their providers, expiry and purpose, and the cookie banner will request consent before they are set.

5. Who we share your data with

We share data only where it is necessary and lawful. Recipients fall into the following categories:

• NHS Trusts, Integrated Care Boards and Local Authorities — for care planning, commissioning, safeguarding and housing-benefit administration.
• Care Coordinators, Social Workers, Probation Officers and Healthcare Professionals — where they are involved in your care.
• Department for Work and Pensions (DWP) and Local Authority Housing Benefit teams — for benefit and Universal Credit administration where you have authorised it.
• Contractors providing repairs and maintenance — limited to what they need to attend the property.
• Professional advisors — auditors, insurers, lawyers and accountants, under duties of confidentiality.
• The Housing Ombudsman, the Regulator of Social Housing, the Care Quality Commission, the Information Commissioner's Office — where a regulator requires it.
• Service providers operating on our behalf as data processors: Cloudflare (hosting and security), Resend (email delivery), Anthropic (AI assistant on our website). Each is bound by a written data-processing agreement.

We do not sell your personal data and we do not use it for advertising.

6. International transfers

Some of our service providers process data outside the United Kingdom. Where that happens we make sure the transfer is protected. In particular:

• Resend (email delivery for our website forms) processes data in the United States. Transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Anthropic (the AI assistant that answers questions on our website) processes prompts in the United States under equivalent safeguards.
• Cloudflare serves the website from a global network; data in transit is encrypted, and the contractual safeguards for any out-of-UK processing are in place.

You can ask for a copy of the relevant safeguards by contacting us at the address in section 11.

7. How long we keep your data

We keep personal data only as long as we need it. Indicative retention periods:

• Care and support records: 8 years after the last episode of care (NHS Records Management Code of Practice).
• Tenancy and licence records: 6 years after the end of the tenancy or licence (limitation period for contract claims).
• Repair and complaint records: 6 years after closure.
• Safeguarding records: in line with the local authority's retention schedule, typically until the person's 25th birthday for children or longer where there is an ongoing risk.
• Recruitment records (unsuccessful applicants): 12 months after the recruitment decision.
• Employee records: 6 years after the end of employment (statutory and tax record-keeping).
• Website enquiry data: 24 months from the last interaction.
• Marketing data: until you withdraw consent.

Detailed retention schedules are available from our privacy contact (see section 11).

8. Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data.
• Access your personal data (a "subject access request").
• Have inaccurate data corrected.
• Have data erased, where applicable.
• Restrict or object to processing, where applicable.
• Data portability, where applicable.
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaint with the Information Commissioner's Office (see section 12).

We will respond to a subject access request within one month. If we need longer because the request is complex, we will tell you within the first month.

9. Children

Our services are for adults aged 18 and over. We do not knowingly collect personal data from children through this website. If you believe a child has provided personal data, please contact us so we can delete it.

10. Security

We take appropriate technical and organisational measures to protect your data — including encryption in transit, role-based access controls, staff training, and security testing. No system is completely secure, so we encourage you to use strong, unique passwords and to tell us straight away if you suspect a security incident affecting your data.

11. How to contact us

For any privacy question, to exercise your rights, or to make a subject access request:

• Email: privacy@sls.org.uk
• Post: Privacy Lead, Supported Living Services, 49 Waddington Road, London, E15 1QL
• Telephone: 020 3637 7590

Please make clear which entity your enquiry concerns (Supported Living Services Ltd or SLS Housing Association). If you are not sure, we will route it to the right team.

12. Complaints to the Information Commissioner

You have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your personal data. We would ask that you give us a chance to put things right first, but you can complain to the ICO at any time.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk — 0303 123 1113.

13. Changes to this policy

We review this policy regularly and may update it from time to time. The “Last updated” date at the top of the page shows when the policy last changed. Material changes will be flagged on the website.