Privacy Policy

How personal information is collected, used and protected through the SLS website and services.

Last updated: 24 July 2026

1. About this policy

This Privacy Policy explains how personal data is used when you visit the SLS website, contact us or use an SLS service. Who controls the information depends on the service and the privacy information provided to you:

  • Website, general enquiries, recruitment and care records: Supported Living Services Ltd (Company No. 10359397), registered office 49 Waddington Road, London, E15 1QL, is the controller unless another privacy notice says otherwise.
  • Housing records: the controller is the housing provider named in the relevant tenancy, licence or housing privacy notice.

Where care and housing organisations need to coordinate, each must have a lawful basis for the information it uses and shares. Ask the privacy contact in section 12 if you need the identity of a controller for a particular record.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

  • Identity data: name, date of birth, gender, photographs (with consent).
  • Contact data: postal address, email, telephone number, next-of-kin details.
  • Technical and security data: IP address, browser and device information, form-security signals and the local-storage record of your cookie choices.
  • Communication data: messages sent through contact, referral, feedback, survey and recruitment forms.
  • Tenancy data: tenancy or licence agreement, rent and service-charge records, repair reports, anti-social behaviour reports, neighbourhood-related correspondence.
  • Special-category data: information about your health, mental-health needs, disabilities, ethnicity, sexual orientation or religious beliefs — only where you (or someone authorised to act on your behalf) have provided it as part of a referral, care plan, safeguarding concern or reasonable-adjustment request.
  • Criminal-offence data: only where lawfully necessary, for example during recruitment (DBS checks) or where a forensic-history risk assessment is part of a care referral.

3. Why we use your data and the lawful bases we rely on

Under UK GDPR we must have a lawful basis for every use of your personal data. Where we process special-category data we also rely on an Article 9 condition. The table below sets out our principal processing activities. For more detail about any item, please contact us using the details in section 12.

3.1 Responding to enquiries and referrals

When you contact us through the website, by phone or by email, or when a professional makes a referral on your behalf, we process your data to assess the enquiry and respond.

  • Controller: the website operator for general enquiries and referrals submitted to its care and support team.
  • Article 6 basis: taking steps to enter into a contract (Art 6(1)(b)) where you are the prospective service user; legitimate interests (Art 6(1)(f)) where the contact is on someone else's behalf.
  • Article 9 condition (where health data is shared): provision of health or social care under Art 9(2)(h), under the conditions and safeguards of Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018.

3.2 Providing care and support

Once a care package is in place, we process your data to plan and deliver your care, manage medication, record incidents, support safeguarding decisions, and report to commissioners where required.

  • Controller: the website operator.
  • Article 6 basis: performance of a contract (Art 6(1)(b)); legal obligation under the Health and Social Care Act 2008 and the Care Act 2014 (Art 6(1)(c)); legitimate interests for incident records (Art 6(1)(f)).
  • Article 9 condition: Art 9(2)(h) — provision of health or social care.

3.3 Providing accommodation, managing tenancies and repairs

We process tenancy and licence data to allocate accommodation, collect rent, carry out repairs, manage anti-social behaviour, and comply with our duties as a landlord.

  • Controller: the legal landlord or housing provider named in the relevant tenancy, licence or privacy notice.
  • Article 6 basis: performance of a tenancy or licence contract (Art 6(1)(b)); legal obligation under housing and consumer-protection legislation (Art 6(1)(c)); legitimate interests for safeguarding and neighbourhood management (Art 6(1)(f)).
  • Article 9 condition (where relevant): Art 9(2)(h) for care-related coordination; Art 9(2)(g) (substantial public interest — safeguarding, equality of opportunity) under Schedule 1 of the DPA 2018.

3.4 Marketing, newsletters and surveys

Where you have opted in, we may send you newsletters and ask you to take part in feedback surveys.

  • Controller: the website operator for general newsletters; the controller identified in the relevant housing privacy notice for tenancy-related surveys.
  • Article 6 basis: consent (Art 6(1)(a)). You can withdraw consent at any time using the unsubscribe link or by emailing us.

3.5 Recruitment

When you apply for a role we process the information you provide, along with results from right-to-work, reference and DBS checks where the role requires them.

  • Controller: the website operator.
  • Article 6 basis: taking steps to enter into a contract (Art 6(1)(b)); legal obligation in relation to immigration and safer-recruitment checks (Art 6(1)(c)).
  • Article 10 (criminal-offence data): processing carried out under the substantial-public-interest condition for safeguarding of children and of individuals at risk (DPA 2018 Schedule 1 Part 2 paragraph 18).

3.6 Website operation and security

We use essential browser storage to remember your cookie choices. Public forms load Cloudflare Turnstile so that Cloudflare can assess security and anti-abuse signals. Optional Google Analytics is used only with your consent on selected public marketing pages; it is not used to measure referral forms, resident-support or health-information pages.

  • Controller: the website operator.
  • Article 6 basis: legitimate interests in operating and protecting the website (Art 6(1)(f)).

4. Cookies and browser storage

Public-page analytics and enquiry ad measurement are separate optional choices, both off by default. Select the categories you want and choose “Save choices”, or “Reject optional cookies”. Neither choice affects access to services. Google signals, personalised advertising, enhanced conversions and automatic form tracking remain off.

  • Cookie choices: local-storage key sls_cookie_prefs_v4 stores your separate analytics and enquiry-measurement choices and timestamp for up to six months. Older notice acknowledgements are not treated as analytics consent.
  • Cloudflare Turnstile: loaded only on pages with public forms. It processes browser, device, network and interaction signals needed to distinguish people from automated abuse. Cloudflare may use strictly necessary browser technologies as part of that security service.

With consent, Google Analytics uses _ga and _ga_QELL9L309J cookies for up to 60 days to help count visits to selected public pages and understand basic engagement and device information. Page addresses are limited to an approved list, without query strings or fragments; only recognised referring-site origins and a fixed set of campaign source/medium labels are retained, without search terms or campaign names. Form content is not sent. We do not send names, contact details, user IDs or health/referral information. Google processes this data to provide website-usage reports; data may be processed outside the UK. The legal basis for optional analytics is your consent (Art 6(1)(a)).

With separate enquiry ad-measurement consent, we retain an opaque Google ad-click identifier in sls_ad_click_v1 for up to 30 days. After a successful submission of the contact-details-only housing enquiry, a separate confirmation page sends Google Ads the completion event, ad-click identifier and a random duplicate-prevention reference. Google also receives browser/network information such as IP address and may set _gcl_* advertising measurement cookies (normally up to 90 days). This measures which ads result in enquiries; it does not measure detailed referral submissions or send names, contact details, support needs, form text or health information. Google may process this data outside the UK. The legal basis for this optional measurement is consent. The temporary confirmation receipt in session storage expires after two minutes and is consumed once.

You can change or withdraw your choice at any time using “Cookie information” in the footer. Rejecting optional cookies stops further measurement and removes Analytics/Ads measurement cookies and the retained ad-click identifier from this site. Read Google's privacy policy.

5. Who we share your data with

We share data only where it is necessary and lawful. Recipients fall into the following categories:

  • NHS Trusts, Integrated Care Boards and Local Authorities — for care planning, commissioning, safeguarding and housing-benefit administration.
  • Care Coordinators, Social Workers, Probation Officers and Healthcare Professionals — where they are involved in your care.
  • Department for Work and Pensions (DWP) and Local Authority Housing Benefit teams — for benefit and Universal Credit administration where you have authorised it.
  • Contractors providing repairs and maintenance — limited to what they need to attend the property.
  • Professional advisors — auditors, insurers, lawyers and accountants, under duties of confidentiality.
  • The competent regulator, Ombudsman or public authority where it has jurisdiction and there is a lawful reason to share.
  • Technology providers: Cloudflare (hosting and form security), Resend (email delivery) and Anthropic (the Alfred AI assistant).

We do not sell your personal data or use enquiry details for personalised advertising. Optional Google measurement is described above.

6. Alfred AI assistant

Alfred provides general website information. It is not used to make care, housing, referral, eligibility, safeguarding, medical or legal decisions. AI answers can be incomplete or wrong.

  • Prompts and the visible conversation history are sent to Anthropic to generate a reply.
  • The SLS website does not write the chat history to its own database.
  • The service blocks some obvious identifiers, but that check cannot detect every type of personal or sensitive information.
  • Do not enter names, contact details, dates of birth, addresses, health information, tenancy information, account information or safeguarding details.
  • Use a human contact route for an individual case. Call 999 for immediate danger and use the safeguarding page for safety concerns.

7. International transfers

Some service providers may process data outside the United Kingdom. Where that happens, the controller must make sure the transfer is protected. In particular:

  • Resend may process website form data outside the United Kingdom.
  • Anthropic may process Alfred prompts and replies outside the United Kingdom.
  • Cloudflare operates a global network and may process security and hosting data outside the United Kingdom.

Where a restricted transfer occurs, the controller must use an applicable UK adequacy regulation or contractual safeguard and complete the required transfer assessment. Ask the privacy contact for the current provider, location, retention period and transfer mechanism before submitting sensitive information.

8. How long we keep your data

We keep personal data only while it is needed for the stated purpose and any applicable care, safeguarding, employment, tax, contract, complaint or legal-claims requirement. The exact period depends on the controller and record type:

  • Care, support and safeguarding records: according to the care provider's approved records schedule, regulatory requirements and any continuing safeguarding or legal need.
  • Tenancy, licence, repair and housing-complaint records: according to the named landlord or housing controller's approved schedule and applicable limitation or regulatory periods.
  • Recruitment and employment records: according to the recruitment outcome and applicable employment, safer-recruitment, immigration and tax requirements.
  • Website enquiries: the website does not maintain a separate enquiry database. A submission is delivered to the relevant SLS mailbox and retained under the applicable mailbox and case-record schedule.
  • Alfred chat: not stored in an SLS website database. Provider-side API logging and retention are governed by the current Anthropic contract and should be confirmed with the privacy contact.
  • Marketing data: until consent is withdrawn or the controller's periodic review shows it is no longer current or necessary.

Ask the privacy contact in section 12 for the period and deletion criteria that apply to a particular record. The organisation responsible for each record must maintain and approve the detailed retention schedule; source code alone cannot establish that operational control.

9. Your rights

Under UK GDPR you have the right to:

  • Be informed about how we use your data.
  • Access your personal data (a "subject access request").
  • Have inaccurate data corrected.
  • Have data erased, where applicable.
  • Restrict or object to processing, where applicable.
  • Data portability, where applicable.
  • Withdraw consent at any time, where we rely on consent.
  • Lodge a complaint with the Information Commissioner's Office (see section 13).

We will respond to a subject access request within one month. If we need longer because the request is complex, we will tell you within the first month.

10. Children

Our services are for adults aged 18 and over. We do not knowingly collect personal data from children through this website. If you believe a child has provided personal data, please contact us so we can delete it.

11. Security

The public website uses HTTPS, server-side validation, bounded inputs and Cloudflare Turnstile on public forms. Access to form messages is restricted through the relevant email and service-provider accounts. No system is completely secure, so do not send passwords or full clinical records through a general enquiry form and tell us promptly if you suspect a security incident.

12. How to contact us

For any privacy question, to exercise your rights, or to make a subject access request:

  • Email: privacy@sls.org.uk
  • Post: Privacy Lead, Supported Living Services, 49 Waddington Road, London, E15 1QL
  • Telephone: 020 3637 7590

Please say whether your request concerns this website, care and support, or housing. If you are not sure who the controller is, we will identify and route it.

13. Complaints to the Information Commissioner

You have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have handled your personal data. We would ask that you give us a chance to put things right first, but you can complain to the ICO at any time.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk — 0303 123 1113.

14. Changes to this policy

We review this policy regularly and may update it from time to time. The “Last updated” date at the top of the page shows when the policy last changed. Material changes will be flagged on the website.