Privacy Notice

Autograph Care Group Website Privacy Notice

Version number: 4.0
Last Updated: 1st July 2026

Introduction

Autograph Care Group and our Group organisations (“ACG”, “us”, “we”, “our”) are committed to protecting the privacy and security of your personal data. We have developed this privacy notice to inform you of the data we collect, what we do with it, what we do to keep it secure, as well as your individual rights.

Throughout this notice we refer to data protection legislation which includes the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other laws mandating data protection including (but not limited to) the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended. This also includes any replacement legislation which may come into effect from time to time.

The following group companies are registered as Controllers in the UK with the Information Commission (“IC”)

  • Autograph Care Group Holdings Ltd, registration number ZB489095;
  • St Catherine’s Care Homes Limited, registration number ZB581785;
  • Northern Care Homes Limited, registration number ZB581802; and
  • ACG Operations Limited, registration number ZB581780.


This privacy notice applies to:

  • Autograph Care Group
  • Walton Manor Care Home
  • Monson Care Home
  • Inwood House Care Home
  • Stoneswood Retirement Home

Each member of our group organisation is considered a separate Controller and not joint Controllers with each other or with our head office. 

For all care enquiries, please call 0121 222 9574, email enquiries@autograph.care, or write to:
Browne Jacobson LLP,
15th Floor,
103 Colmore Row,
Birmingham.
B3 3AG

For careers enquiries, please call 0121 222 9574,or email careers@autograph.care.

We have appointed an external Data Protection Officer (“DPO”), details as follows:
Evalian Limited
West Lodge
Leylands Business Park
Colden Common
Hampshire
SO21 1TH
United Kingdom

Email: dpo@autographcare.co.uk
Phone: +44 (0)333 050 0111
Website: www.evalian.co.uk 

Lawful Basis for Processing

The UK GDPR requires Autograph Care to identify appropriate lawful bases for processing personal data. The lawful basis we rely on are detailed below with brief examples for when they may apply:

Consent
For opting into marketing communications and newsletters

Contractual Obligation
To take steps into entering and concluding residential care contracts

Vital Interests
To ensure we know about medical conditions of our residents should they require medical attention

Legitimate Interests
To help answer any questions or concerns from individuals with which we have no existing relationship

We will only process the “special categories” of more sensitive Personal Data where necessary and where we meet one of the conditions required by law for doing so.

Personal Data Collected

When you visit our website and complete our online forms, we may process the following categories of Personal Data:

  • First name;
  • Last name;
  • Email address;
  • Phone number;
  • Care requirements; and
  • Family details.

The above list is representative and non-exhaustive, as we have a free-text box in which you can add additional personal details if you wish.

How We Use Personal Data

We may use your personal data for the following purposes:

  • Handling an enquiry about our services;
  • Making steps to provide health and social care to prospective residents;
  • Seeking your views or comments on the services we provide;
  • Notifying you of changes to our services;
  • Sending marketing communications and other company updates; and
  • Monitoring website usage.

The above list is non-exhaustive and representative. For more information to how we use personal data for specific activities you can contact us as detailed above.

Recruitment

From time to time we may advertise job vacancies on our website. Full details of how personal data is processed for recruitment is contained within our job applicant privacy notice, available upon request.

International Data Transfers

There may be instances where we may transfer your personal data outside the UK. We may share your data with companies who are in the European Economic Area (the EU member states, plus Norway, Iceland and Liechtenstein – “EEA”), in an adequate listed country or in another third country who may not have similar data protection laws as the UK. If we transfer your information outside the UK, we will take the necessary steps to ensure appropriate security measures are taken with the aim of ensuring your privacy rights continue to be protected, as outlined in this notice.

Cookies

We use cookies on our website. More information on how we use cookies can be found in our cookie notice.

Third-Party Links

Our website includes links to our social media pages which enable you to view our content through selected sites. These applications may collect your IP address or Device ID and may set a cookie on your device. When you use one of these links, you are sharing information to another website or service and this privacy notice will no longer apply. Please read the privacy notices provided by the particular social media website you are sharing through before posting any personal information using these links.

Marketing Communications

We would like to send you marketing news and updates regarding our company, products and services. In order to send you these communications, we require your consent. This consent may be withdrawn at any time by clicking the unsubscribe link at the bottom of the marketing email. You may also opt out of receiving marketing by contacting us by phone or email, using the details provided above.

Data Retention

We will retain your personal data for as long as is necessary to answer your enquiry or provide you with our ongoing services, and for a reasonable period thereafter, to enable us to meet our contractual and legal obligations. At the end of the retention period, your personal data will be securely deleted in accordance with our Personal Data Retention Policy.

Data Security

We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties on a need-to-know basis. 

Data Protection Rights

The UK GDPR provides you with certain rights in relation to the processing of your personal data, including to:

  • Request access to personal data about you (a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing it;
  • Request rectification, correction, or updating to any of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
  • Request personal data provided by you to be transferred in machine-readable format;
  • Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below);
  • Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (e.g. if you want us to establish its accuracy or the reason for processing it); 
  • Lodge a complaint with the Controller of your personal data; and
  • Object to the processing of your personal data in certain circumstances. This right may apply where the processing of your personal data is based on our legitimate interests. 

Some of these rights are not absolute and are subject to various conditions under applicable data protection and privacy legislation and the laws and regulations to which we are subject. If at any time you decide that you no longer wish to be contacted for marketing purposes, or if you would like to exercise any of your rights as set out above, you can contact us at dpo@autographcare.co.uk, or write to the address above. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

In addition to the above, please note that you have the right to make a complaint at any time to the Information Commission if you are concerned about the way in which we are handling your personal data.

Contact

You can contact us in relation to data protection and this privacy notice by emailing dpo@autographcare.co.uk or by writing to the address above.