Privacy

PRIVACY STATEMENT

This Privacy Statement sets out how Eden Housing Association uses and protects any information that you provide to us.  Eden Housing Association is committed to ensuring that your privacy is protected.  Should we ask you to provide any of your information to us, then you can be assured that it will only be used in accordance with this Privacy Statement.

Eden Housing Association may change this statement from time to time by updating this page.  This page was last updated on 19 December 2022.

1. WHAT INFORMATION IS BEING COLLECTED

 

Eden Housing Association will be what is known as the ‘Controller’ of the personal data you provide to us. We may collect, process and store information such as:

• Tenant names, date of birth, National Insurance numbers, photographs, contact details and preferences
• References from landlords, support providers or other people vouching for applicants’ suitability as a tenant
• The details of other family members or people living in our properties
• The details of nominated persons who can speak on your behalf including name, contact telephone numbers and address
• Rent payments made
• Income and expenditure estimates
• Repairs requested
• Tenancy agreements
• Physical/Medical Condition
• Support contracts
• Support plans and details of support providers
• Complaints about our services
• Responses to surveys or involvement initiatives
• Allegations of anti-social behaviour
• Convictions, proceedings and criminal acts
• Correspondence to and from our residents, service users, other agencies or advocates
• Recordings of telephone calls made to and from the organisation, these recordings are stopped when payment card information is given over the phone
• CCTV is in place at our main office and as such record and retain information and CCTV images. If you live in a supported accommodation with the provision of CCTV; the CCTV systems record and retain information to safeguard your health and security.
• Visitors attending meetings within our building will sign in at our reception using a visitor sign in system, this will take a photo which is secured within a secure UK datacentre.
• Job applications

Data relating specifically to children

As an organisation we will collect information about household members of a tenancy which may include details of any children in that property.  This data is used only specifically to ensure we hold the correct details of the tenancy or to help assess and allocate appropriate housing through our Choice Based Lettings system, this data will not be used for any other purpose than of that relating to the tenancy, housing application or in relation to a homeless application.

We may collect and store data relating to children where we are dealing with welfare issues encountered within our housing management processes or within our homeless service. This information is not shared for any other purposes but for the support for the childs welfare. Their data will not be used for any direct marketing, or services. We will use this data to ensure we can produce necessary support plans or to store certain child protection plans.

The purpose for which we would share this data, would be in relation to safeguarding a child. We will share data with Myspace if required in relation to referrals for move on accommodation.

Some information is treated as more sensitive and as such are classed as special categories of data under GDPR for example information about an individual’s:

• race
• ethnic origin
• politics
• religion
• trade union membership
• genetics
• biometrics (where used for ID purposes)
• health
• sex life; or
• sexual orientation

As such, Eden Housing Association will ask your explicit consent when you start a tenancy with us, or accept a job offer to ensure you agree to us collecting one or more of these types of data. If, however, we have a legal requirement to collect or there is a need to protect the vital interest of you or another person by collecting this information, we will ensure you will be told clearly at the point this information is collected.

You have the right, in certain circumstances, if there is not a legal requirement for us to process this type of data, to refuse consent. We will ensure our records are updated if you do not consent or you wish to remove consent at a later date.

When you apply to become an Eden Housing Association customer, we request and hold on file any references necessary to assess your application.  This may include (but is not limited to), where appropriate, information from other landlords, the Police, the Probation Service, support services, Social Services, and health services.  We may also use information to carry out checks with client reporting agencies.

We may apply markers to your information (for example, in relation to your vulnerability or health status) to enable us to tailor and deliver services to you.  It is important that you notify us of any changes to your personal information.

The information we collect from you can come from many different methods, the main sources we receive information from are as follows

• Customer Portal (MyAccount)
• Customer Service center when you contact us directly
• Personal Interviews whether that is face to face or using other forms of communication.
• Application Forms, through the Choice Base Lettings system or our own application forms for other services
• Local Authorities/Government AgenciesThe information we collect from you can come from many different methods, the main sources we receive information from are as follows

2.         GOOGLE ANALYTICS

We use Google Analytics to collect anonymous information about use of our website.

Google Analytics collects information such as how often users visit this site, what pages they visit when they do so, and what other sites they used prior to coming to this site. We use the information we get from Google Analytics only to improve our website.

Although Google Analytics places a permanent cookie on your web browser to identify you as a unique user next time you visit our website, the cookie cannot be used by anyone but Google whose ability to use and share information collected by Google Analytics about your visits to this site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.

Google Analytics uses cookies to define user sessions, which allows for the collection of data about how visitors are using the websites. First Party Cookies are used which means that the cookies are linked to a specific website domain and Google Analytics will only use that cookie for statistical analysis related to your browsing behavior on that specific website.

If you wish to, you can opt out by turning off cookies in the preferences settings in your web browser or you can use Google’s opt out tool within Chrome.

3.         HOW WILL WE USE THE INFORMATION WE COLLECT

We process personal information for certain legitimate business purposes, which include some or all of the following:  

• Where the processing enables us to enhance modify, personalise or otherwise improve our services/communications for the benefit of the customer
• To identify and prevent fraud
• To enhance the security of our network and information systems
• To better understand how you interact with our websites
• To provide postal communications which will be of interest to you
• To determine the effectiveness of promotional campaigns and advertising
• Assess your suitability for a job vacancy or to assess your suitability to become a Board Member

Whenever we process data for these purposes we will ensure that we always keep your personal data rights in high regard and take account of these rights. You have the right to object to this processing if you wish – please see ‘how to contact us’ section. Please bear in mind that if you object this may affect our ability to carry out tasks above for your benefit.

4. WHAT WILL WE DO WITH IT

 

Access to your information will normally be limited to ourselves. However, there may be occasions when we disclose your details to others for legitimate business reasons or we are legally obliged to do so.

5.   LEGALLY OBLIGED

We will share specific and relevant information with law enforcement and government agencies or public bodies where we are legally required to do so. Examples may include:

• The prevention or detection of crime and fraud
• The apprehension or prosecution of offenders
• The assessment or collection of tax or duty owed to customs and excise
• Sharing in connection with legal proceedings
• Sharing in relation to the physical or mental health of an individual, where disclosure is required to protect them or others from serious harm
• Research and statistical purposes

We may also share your information with emergency services and local authorities, where this is necessary to help them respond to an emergency situation that affects you.

6.  CONTRACTORS AND SUPPLIERS

We may share your personal information with our suppliers who enable us to provide services to you, or who provide services on our behalf. Examples of those suppliers are maintenance contractors who carry out work in tenants’ homes; the contractor who handles your out of hours service calls for us; companies that assist us in mailing out our notices and letters. The data shared is the specific information the supplier requires to carry out their task, as well as any information that ensures we fulfil our health and safety obligations to the people carrying out the task.

7.  UTILITY COMPANIES

In order to assist utility providers (gas, electricity and water, etc) deliver their services and collect revenue, we will provide on request names and contact details of new tenants, and forwarding addresses of former tenants, as well as tenancy dates.

8.  LOCAL COUNCILS AND GOVERNMENT DEPARTMENTS

We may also need to share information with local councils, social services and Department of Work and Pensions.

We send information about new letting to the Ministry of Housing (CORE) – however this does not identify individuals and only provides information for research.

9.  PARTNER AGENCIES

We may enter into partnerships with other organisations such as local authorities and the Police. For example, we may join a partnership to help prevent and control anti-social behaviour.  We will enter into a formal data sharing agreement to govern the process and ensure it is lawful. That agreement will be approved by our Data Protection Officer before it is implemented.

We are in partnership with Cumbria Choice to offer a Cumbria-wide housing allocation service. When becoming an applicant on Cumbria Choice you will specify the landlord who you wish to manage your application. If you chose Eden Housing Association, we will ensure all of your personal data is kept secure in accordance with the Cumbria Choice Privacy Statement and our own Data Protection Policy. For further information on the Cumbria Choice Privacy Statement please visit www.cumbriachoice.org.uk.

We carry out a Homeless Prevention Service on behalf of the local authority.  When you enter into this service we need to obtain and process personal information about you and your circumstances in order to carry out our lawful duty to asses your application for homeless assistance under Part 7 of the Housing Act 1996.

We will collect your data under the “Public task Basis” (in this case to assess your application for homelessness assistance and to perform and discharge any duties that may arise out of the application).  This permits processing for a task carried out in the public interest or in the exercise of official authority for social protection purposes.

The processing is necessary for us to enable the local authority to perform a task in the public interest.  For further information on the local authority privacy notice linked with this service please visit http://www.eden.gov.uk

Other Organisations

Eden Housing Association may use other organisations to process personal data on our behalf, for example some processors we use, but are not limited to are:

• Cumbria Mailing – for the provision of mailing tenant wide, rent Increase notices and statements, this may include other organisation wide mailshots.
• Allpay – for the secure processing of card payments
• Survey Monkey – for the purpose of gathering service satisfaction data from our customers
• The Deposit Protection Service – to deposit payments received for our Lakeland and Borders Private tenancies – this is a legal requirement
• Acuity Research and Practice (market research company) – for carrying out tenant satisfaction surveys

In addition, we may also be required to share information with other organisations\agencies, where we have lawful reason or a legitimate interest to do so.  Where the sharing of your personal data does not meet a lawful reason or a legitimate interest to share we will seek to obtain your consent. Some examples of these additional organisations/agencies are listed below but are not limited to:

• TV license company if you are entitled to a subsidised licence if you live in sheltered/extra care accommodation.
• Local GP
• Local Pharmacies specific to your care
• Local support services specific to your care and wellbeing

Eden Housing Association remains responsible for the fair and lawful processing of personal data shared with suppliers. We ensure this occurs through setting Data Sharing Agreements and Policies with our contractors and suppliers where necessary.

10.  WHAT ARE YOUR RIGHTS?

We aim to ensure that staff and Board Members do not misuse any confidential information, or pass on this information improperly to a third party. We protect personal information by applying technical measures, implementing policies, training staff and carrying out checks on practice.

Consent

You have the right to withdraw consent to us processing your personal information at any time so long as the information is not part of a statutory or contractual requirement/obligation. We would however like you to be aware that this may affect the quality of service we can provide to you.  For example, we need to know the composition of your family so that we can allocate a suitably sized property to you.

You have the right to object to direct marketing from the Association. This may include postal surveys, SMS Repairs satisfaction surveys, tenant satisfaction questionnaires, tenant profiling etc. To withdraw consent at any time, please contact the Data Protection Officer.

Right To Data Portability

When processing your personal data to fulfil a contract to which you are a party, you have the right to request electronically held personal data to enable easy transfer to another organisation. Where it is technically feasible you may request that the data be transferred directly between organisations. Once the request is made, the data should be provided to you within 30 days.  This data will only contain your own personal data and any other data that could identify other people will be redacted.

Right to be informed

You have the right to be informed on the reasons we hold and process your personal data, and how long we will hold your information for. This is in the format of our Privacy Statement, that maybe updated from time to time, if there are any changes in the way we process your data.

 Right to access

You have the right to request access to your data. If you can, make a Subject Access Request to the organisation in writing. Once the request is received we will respond to the request within 30 days.

Right to erasure (Right to be forgotten)

You have the right to have the information we hold on you deleted where the use of that information would no longer meet the requirements of the General Data Protection Regulation.  Once the request is made, the information must be deleted within 30 days.

Where the data in question has been made public or transferred to a third party, we must also take reasonable steps to inform those third parties about the request for deletion including any links to, or copies of that personal data. The above does not apply when it is necessary to keep the data in relation to legal proceedings, to comply with a statutory obligation, or to perform tasks in the public interest.

Right To Rectification, To Object And To Restriction Of Processing

Rectification: you have the right to have inaccurate and incomplete data about you rectified and completed.

Right to object: in certain circumstances, you have the right to object your personal information being processed.  Depending on the legal basis for processing, this may either be an absolute right (ie direct marketing), or may be subject to us being able to demonstrate compelling legitimate grounds which would override your own interests, or where the information is needed for the purposes of legal claims.

Right to restriction: you have the right to request that information is no longer processed (other than it being stored) in particular circumstances, such as when we are dealing with the correction of any inaccurate information; the processing is unlawful but you object to its erasure; or the information is no longer needed but you require the information to be kept for the purposes of a legal claim.

11. HOW LONG DO WE KEEP YOUR DATA

We have a Document Retention Policy in place which outlines how long we will keep different types of information for. This Policy is regularly reviewed and based around Good Practice Guidance issued by the National Housing Federation.

12.  HOW WE WILL SECURE YOUR DATA

 Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect and hold.

If you subscribe to our online tenant services by registering and signing up to ‘MyAccount’ we will hold and store your log on details securely.  We do not store your password.  This information is necessary to enable you to access your own data so we can verify you as an account holder.  The data you see within ‘My Account’ is held in secure systems which are tested routinely for security and policies are followed in accordance with GDPR to ensure safe removal and retention is applied.

Secure storage

Paper files and records containing personal information are kept secure. Staff are provided with guidance on secure handling of records when taken from the office – for example, when carrying out a home visit.

We ensure any information on our computer system is secure, accurate, relevant and necessary. All our computers are secured with passwords, and staff are all fully trained on our systems. The personal data held on mobile IT devices is minimised, encrypted wherever possible and technical measures taken to secure data should a device be lost or stolen.

Telephone enquiries

When a tenant or housing applicant contacts us by phone, they will be asked to provide a piece of identifying data. This could be a tenancy password or reference number or application ID to ensure that personal information is only disclosed to the correct person.  If a tenant would like someone else to contact us on their behalf they need to confirm that to us directly, or if it is an ongoing arrangement, complete a written request.

Complaints

If someone contacts us to raise a complaint on your behalf we will always seek your permission first. This is because in responding to the complaint, the person claiming to represent you might view some of your personal data.

Rent enquiries

If you want to make an enquiry about your rent, eg your payment history or the balance of your account, we will ask you to quote to us your ‘Tenancy Password’.  Every tenant has the option to create a password. If you do not know your Tenancy password we will ask for your full name and date of birth before giving you any details about your rent account. We may include other security questions to ensure your data is not disclosed to unauthorised persons.

13.  DATA PROTECTION IMPACT ASSESSMENT

 A Data Protection Impact Assessment (DPIA) is a process to identify and minimise the data protection risks of a project that may be undertaken by Eden Housing Association.

An Assessment will be carried out on all projects that could result in a high risk to individuals’ personal data. Any projects deemed high risk will be assessed and passed to the Data Protection Officer before deciding on whether the risk can be mitigated to ensure safety of data. If there is no way to mitigate or reduce the risk accordingly the process will not go ahead, therefore ensuring personal data is kept secure and safe.

14.  ACCESSING YOUR PERSONAL INFORMATION

General Data Protection Regulation gives you a number of rights in relation to your personal information. You can find out more about your rights, and get further guidance, on the Information Commissioner Office’s website. http://www.ico.co.uk/

You have the right to access files or other records containing information relating to:

• Your present tenancy
• Your past tenancies
• Proposed tenancies
• Support Plans

 15. CONTROLLING YOUR PERSONAL INFORMATION

You may choose to restrict the collection or use of your personal information in the following ways:

• You may change your mind at any time if you have previously opted into a direct marketing, if you wish to be removed from this please contact us and let us know and we will ensure you are removed from any lists (please see ‘How to contact us’ section).
• We may use your personal information to send you promotional information about third parties which we think you may find interesting where you have given us your consent to contact you with such information.
• You are entitled under data protection legislation to request a copy of any personal information which we hold about you.  Such requests should be made in writing (please see ‘How to contact us’ section).
• If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible (please see ‘How to contact us’ section).

Please note the following important information about accessing your personal information:

• You can make your request in writing. All requests are passed by staff to our Data Protection Officer to ensure we act in accordance with the General Data Protection Regulation.
• To help us respond, please be as specific as you can be about the information you would like to see.
• Under the legislation, we have up to 30 days from the date you request the information to provide it to you.
• You have the right to ask us to delete or change any inaccurate information held on our files. We consider all requests and will change or delete information that we agree is inaccurate.

Because we also need to respect the rights of others, we cannot make the following information available to you:

• Information relating to, or identifying a third party, unless that person has given their written permission
• Information from other agencies such as Social Services, doctors or lawyers which could reasonably be expected to be treated as confidential
• Information that could cause physical or mental harm

The decision to refuse an individual access to personal information about themselves is taken at ‘Manager’ level within the Association, in liaison with our Data Protection Officer.

We will identify ourselves and provide a contact number for you to confirm our identity on request when contacting you about our services.

If at any point you believe the information we process on you is incorrect you may request to see this information and even have it corrected or deleted. If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter.

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO). The ICO contact details are available on its website at www.ico.org.uk

The Data Protection Officer is responsible for handling queries surrounding your data, please see the ‘How to Contact us’ Section.

16.  HOW TO CONTACT US

If you wish to contact us either to change the way in which you receive communications from us; or to request further information in relation to this Privacy Statement, or you wish to be provided with copies of the data we hold, you can contact us in one of the following ways:

• Telephone: 01768 861400
• Email: dpo @edenha.org.uk
• Address: Eden Housing Association, Blain House, Bridge Lane, Penrith, Cumbria, CA11 8QU
• Please address correspondence ‘FAO Data Protection Officer’. We will promptly correct any information found to be incorrect.