Privacy Policy

Privacy Policy

How we use personal information collected through our website

Last updated: 6 July 2026

1. Who we are

Chiltern Care Services Limited, trading as Cherry Tree Nursing Home, is the controller of personal information described in this policy. This means we decide why and how that information is used.

Company number: 03445881

Registered office: Cherry Tree Nursing Home, Bledlow Road, Saunderton, Princes Risborough, Buckinghamshire, England, HP27 9NG

Email: enquiries@chilterncare.co.uk

Telephone: 01844 346259

Data Protection Officer: Rishi Dhot (contact through enquiries@chilterncare.co.uk or the registered office)

ICO registration number: Z7594614

This policy applies to information collected through our website, including contact enquiries, requests to arrange a visit, care enquiries, marketing preferences and job applications. If you become a resident, employee or other service user, we may provide additional privacy information that is specific to that relationship.

2. Information we collect

Contact and enquiry information

We may collect your name, email address, telephone number, the content of your enquiry, your preferred method of contact and records of our correspondence with you.

Care enquiry information

If you ask about care for yourself or someone else, you may choose to give us information about care needs, health, mobility, medication, capacity, family or representative relationships, funding arrangements and other circumstances relevant to the enquiry. Please provide only the information needed for us to respond safely and appropriately.

Recruitment information

If you apply for work, we may collect your contact details, CV, employment and education history, qualifications, skills, availability, right-to-work information, referee details and anything else you include in your application or correspondence. We do not ask for criminal record information through the initial website form. Any later checks, including Disclosure and Barring Service checks, will be carried out only where appropriate and lawful, with separate information provided where needed.

We accept applications for advertised roles and speculative applications. Equality-monitoring and health information may be collected later in the application process, but is not requested through the initial website form. Separate information will be provided where appropriate.

Technical and usage information

Our website and hosting systems may record technical information such as your IP address, browser and device type, pages requested, dates and times, referring page, diagnostic information and security logs. Our use of cookies and similar technologies is explained in the Cookie Policy.

Marketing preferences

We currently publish news and updates on our website. If we introduce an email mailing list, we will record the choices and contact details of people who actively choose to subscribe. Marketing consent will be optional, will not be required to make an enquiry or apply for a job, and can be withdrawn at any time.

3. Information about another person

If you provide information about a relative, prospective resident, referee or another person, you should have an appropriate reason and authority to do so. Do not include unnecessary or excessive personal or health information in a website form.

We may also receive information about a prospective resident from relatives, representatives, hospitals, healthcare professionals, local authorities, NHS bodies, commissioners or other care providers. The information may include contact details, its source, care needs, health information, funding arrangements and other information needed to assess or arrange care.

Where data protection law requires us to do so, we will provide the person concerned with privacy information directly within the applicable period, unless a legal exception applies. We will keep a record of any exception on which we rely.

4. How and why we use personal information

Responding to enquiries and arranging visits

We use contact and enquiry information to respond, provide relevant information, discuss availability, arrange a visit and take steps requested before a possible contract. Depending on the circumstances, our lawful bases are taking steps at your request before entering into a contract and our legitimate interests in responding to genuine enquiries and operating our care home.

Assessing and arranging care

We use information supplied in a care enquiry to understand needs, determine whether we may be able to provide suitable care, communicate with authorised family members or professionals and support safe admission planning. Our lawful bases may include taking steps before a contract, our legitimate interests, legal obligations and, where health or other special category information is necessary, the provision or management of health or social care under applicable UK data protection law.

Recruitment

We use application information to assess suitability, communicate with candidates, arrange interviews, verify information, make recruitment decisions and establish or defend legal claims. Our lawful bases include taking steps at the candidate’s request before an employment contract, our legitimate interests in recruiting suitable staff and compliance with legal obligations. If special category information is relevant, we use it only where an additional legal condition applies, including employment-law obligations or other conditions permitted by law.

Marketing

If we introduce an email mailing list, we will use your email address for news and updates only where you have given consent or another lawful route clearly applies. You will be able to withdraw consent or opt out at any time using the unsubscribe method provided or by contacting us. Withdrawing consent will not affect use of your information before withdrawal.

Website operation, security and improvement

We use technical information where necessary to operate, protect and troubleshoot the website, prevent misuse, maintain records and understand general website performance. Our lawful basis is our legitimate interest in running a secure and effective website. Where cookie consent is required, we will ask for it before using the relevant technology.

Legal and regulatory purposes

We may use personal information to comply with law, respond to regulators or public authorities, protect residents, staff and visitors, deal with complaints, prevent or investigate wrongdoing and establish, exercise or defend legal claims.

5. Our legitimate interests

Where we rely on legitimate interests, those interests include responding to genuine enquiries, considering whether we can provide suitable care, recruiting and managing our workforce, maintaining appropriate business records, protecting our systems and people, preventing fraud or misuse, improving our website and managing legal or regulatory matters. We consider whether the use is necessary and balance these interests against the rights and expectations of the people affected.

6. Who we share information with

We share personal information only where necessary and proportionate. Recipients may include authorised members of our team; Webcapitan where it supports or maintains the website; Microsoft where it provides email, Azure, SharePoint or related cloud services; other website, hosting, IT, secure-storage and recruitment service providers acting for us; GPs, hospitals and other healthcare professionals; NHS bodies, commissioners, local authorities or other care providers involved in an enquiry or admission; recruitment agencies; professional advisers, auditors and insurers; the Care Quality Commission, safeguarding bodies, law-enforcement agencies, courts or other regulators and public authorities where required or permitted by law; and a prospective buyer, investor or successor if our business or assets are reorganised or transferred.
We do not sell personal information.

7. International transfers

Our Microsoft and other technology suppliers may store information in the United Kingdom while permitting limited support, security or administrative access from other countries. Future website or mailing-list tools may also involve processing outside the United Kingdom. Where a restricted transfer occurs, we will use a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and take appropriate steps to protect the information. You may contact our Data Protection Officer for information about safeguards relevant to your information.

8. How long we keep information

General enquiries

If an enquiry does not lead to a care-service relationship, we normally retain the enquiry and related correspondence for up to 24 months after the last meaningful contact, unless a longer period is needed for a complaint, safeguarding concern, legal claim or regulatory requirement.

Care enquiries that progress

If an enquiry progresses to assessment, admission or care, relevant information becomes part of the applicable resident or service record and is retained under our care-record retention arrangements and legal or regulatory requirements.

Recruitment

For an unsuccessful application, we normally retain recruitment records for 6 months after the recruitment decision. If you agree that we may consider you for future roles, we may retain relevant information for up to 12 months. Information about successful candidates becomes part of the employment record and is retained under our employment retention arrangements.

Marketing and technical records

We retain marketing contact details until you unsubscribe or we stop the relevant activity, after which we may keep a minimal suppression record so that we respect your choice. Routine technical and security logs are normally retained for up to 12 months, but relevant records may be kept longer where an incident is being investigated.

We may delete or anonymise information earlier where it is no longer needed.

9. Security

We use appropriate organisational and technical measures designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Access is limited to people and suppliers who need the information for an authorised purpose. No internet transmission or storage system can be guaranteed completely secure, so please avoid sending unnecessary sensitive information through a general website form.
Website enquiries are received through our Microsoft-hosted email service. Relevant information may be entered into Excel records stored in Microsoft SharePoint. Privacy or security concerns can be reported to enquiries@chilterncare.co.uk for the attention of the Data Protection Officer.

10. Your data protection rights

Depending on the circumstances and lawful basis, you may have rights to ask for access to your personal information; correction of inaccurate or incomplete information; deletion; restriction of use; transfer of information you provided in a portable format; and withdrawal of consent. You may also have rights relating to automated decisions. We do not use website enquiry or recruitment information to make decisions based solely on automated processing that produce legal or similarly significant effects.

Some rights are subject to conditions and exemptions. We may ask for information needed to verify your identity before acting on a request. To exercise a right, contact enquiries@chilterncare.co.uk or write to the registered office above.

Required fields are identified on the relevant form. If you do not provide the required information, we may be unable to respond to your enquiry or consider your application.

11. Your right to object

12. Complaints

Please contact us first if you have a concern about how we use personal information. We will consider the matter and respond in line with our complaints process.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You can visit ico.org.uk/make-a-complaint, call 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Changes to this policy

We may update this policy to reflect changes in law, our services or the way the website operates. The current version will be published on this page with its last-updated date. If a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people.