This Privacy Statement sets out how Eden Housing Association uses and protects any information that you provide to us. Eden Housing Association is committed to ensuring that your privacy is protected. Should we ask you to provide any of your information to us, then you can be assured that it will only be used in accordance with this Privacy Statement.
Eden Housing Association may change this statement from time to time by updating this page. This page was last updated on 24 May 2018.
- WHAT INFORMATION IS BEING COLLECTED
Eden Housing Association will be what is known as the ‘Controller’ of the personal data you provide to us. We may collect, process and store information such as:
- Tenant names, date of birth, National Insurance numbers, photographs, contact details and preferences
- References from landlords, support providers or other people vouching for applicants’ suitability as a tenant
- The details of other family members or people living in our properties
- Rent payments made
- Income and expenditure estimates
- Repairs requested
- Tenancy agreements
- Physical/Medical Condition
- Support contracts
- Support plans and details of support providers
- Complaints about our services
- Responses to surveys or involvement initiatives
- Allegations of anti-social behaviour
- Convictions, proceedings and criminal acts
- Correspondence to and from our residents, service users, other agencies or advocates
- Recordings of telephone calls made to and from the organisation, these recordings are stopped when payment card information is given over the phone
- CCTV is in place at our main office and as such record and retain information and CCTV images. If you live in a supported accommodation with the provision of CCTV; the CCTV systems record and retain information to safeguard your health and security.
- Job applications
Some information is treated as more sensitive and as such are classed as special categories of data under GDPR for example information about an individual’s:
- ethnic origin
- trade union membership
- biometrics (where used for ID purposes)
- sex life; or
- sexual orientation
As such, Eden Housing Association will ask your explicit consent when you start a tenancy with us, or accept a job offer to ensure you agree to us collecting one or more of these types of data. If, however, we have a legal requirement to collect or there is a need to protect the vital interest of you or another person by collecting this information, we will ensure you will be told clearly at the point this information is collected.
You have the right, in certain circumstances, if there is not a legal requirement for us to process this type of data, to refuse consent. We will ensure our records are updated if you do not consent or you wish to remove consent at a later date.
When you apply to become an Eden Housing Association customer, we request and hold on file any references necessary to assess your application. This may include (but is not limited to), where appropriate, information from other landlords, the Police, the Probation Service, support services, Social Services, and health services.
We may apply markers to your information (for example, in relation to your vulnerability or health status) to enable us to tailor and deliver services to you. It is important that you notify us of any changes to your personal information.
2. GOOGLE ANALYTICS
We use Google Analytics to collect anonymous information about use of our website.
Google Analytics collects information such as how often users visit this site, what pages they visit when they do so, and what other sites they used prior to coming to this site. We use the information we get from Google Analytics only to improve our website.
If you wish to, you can opt out by turning off cookies in the preferences settings in your web browser or you can use Google’s opt out tool within Chrome.
3. HOW WILL WE USE THE INFORMATION WE COLLECT
We process personal information for certain legitimate business purposes, which include some or all of the following:
- Where the processing enables us to enhance modify, personalise or otherwise improve our services/communications for the benefit of the customer
- To identify and prevent fraud
- To enhance the security of our network and information systems
- To better understand how people interact with our websites
- To provide postal communications which will be of interest to you
- To determine the effectiveness of promotional campaigns and advertising
- Assess your suitability for a job vacancy or to assess your suitability to become a Board Member
Whenever we process data for these purposes we will ensure that we always keep your personal data rights in high regard and take account of these rights. You have the right to object to this processing if you wish – please see ‘how to contact us’ section. Please bear in mind that if you object this may affect our ability to carry out tasks above for your benefit.
- WHAT WILL WE DO WITH IT
Access to your information will normally be limited to ourselves. However, there may be occasions when we disclose your details to others for legitimate business reasons or we are legally obliged to do so.
5. LEGALLY OBLIGED
We will share specific and relevant information with law enforcement and government agencies or public bodies where we are legally required to do so. Examples may include:
- The prevention or detection of crime and fraud
- The apprehension or prosecution of offenders
- The assessment or collection of tax or duty owed to customs and excise
- Sharing in connection with legal proceedings
- Sharing in relation to the physical or mental health of an individual, where disclosure is required to protect them or others from serious harm
- Research and statistical purposes
We may also share your information with emergency services and local authorities, where this is necessary to help them respond to an emergency situation that affects you.
6. CONTRACTORS AND SUPPLIERS
We may share your personal information with our suppliers who enable us to provide services to you, or who provide services on our behalf. Examples of those suppliers are maintenance contractors who carry out work in tenants’ homes; the contractor who handles your out of hours service calls for us; companies that assist us in mailing out our notices and letters. The data shared is the specific information the supplier requires to carry out their task, as well as any information that ensures we fulfil our health and safety obligations to the people carrying out the task.
7. UTILITY COMPANIES
In order to assist utility providers (gas, electricity and water, etc) deliver their services and collect revenue, we will provide on request names and contact details of new tenants, and forwarding addresses of former tenants, as well as tenancy dates.
8. LOCAL COUNCILS AND GOVERNMENT DEPARTMENTS
We may also need to share information with local councils, social services and Department of Work and Pensions.
We send information about new letting to the Ministry of Housing (CORE) – however this does not identify individuals and only provides information for research.
9. PARTNER AGENCIES
We may enter into partnerships with other organisations such as local authorities and the Police. For example, we may join a partnership to help prevent and control anti-social behaviour. We will enter into a formal data sharing agreement to govern the process and ensure it is lawful. That agreement will be approved by our Data Protection Officer before it is implemented.
We are in partnership with Cumbria Choice to offer a Cumbria-wide housing allocation service. When becoming an applicant on Cumbria Choice you will specify the landlord who you wish to manage your application. If you chose Eden Housing Association, we will ensure all of your personal data is kept secure in accordance with the Cumbria Choice Privacy Statement and our own Data Protection Policy. For further information on the Cumbria Choice Privacy Statement please visit www.cumbriachoice.org.uk.
Eden Housing Association may use other organisations to process personal data on our behalf, for example some processors we use, but are not limited to are:
- Cumbria Mailing – for the provision of mailing tenant wide, rent Increase notices and statements, this may include other organisation wide mailshots.
- Allpay – for the secure processing of card payments
- Survey Monkey – for the purpose of gathering service satisfaction data from our customers
- The Deposit Protection Service – to deposit payments received for our Lakeland and Borders Private tenancies – this is a legal requirement
Eden Housing Association remains responsible for the fair and lawful processing of personal data shared with suppliers. We ensure this occurs through setting Data Sharing Agreements and Policies with our contractors and suppliers.
10. WHAT ARE YOUR RIGHTS?
We aim to ensure that staff and Board Members do not misuse any confidential information, or pass on this information improperly to a third party. We protect personal information by applying technical measures, implementing policies, training staff and carrying out checks on practice.
You have the right to withdraw consent to us processing your personal information at any time so long as the information is not part of a statutory or contractual requirement/obligation. We would however like you to be aware that this may affect the quality of service we can provide to you. For example, we need to know the composition of your family so that we can allocate a suitably sized property to you.
You have the right to object to direct marketing from the Association. This may include postal surveys, SMS Repairs satisfaction surveys, tenant satisfaction questionnaires, tenant profiling etc. To withdraw consent at any time, please contact the Data Protection Officer.
Right To Data Portability
When processing your personal data to fulfil a contract to which you are a party, you have the right to request electronically held personal data to enable easy transfer to another organisation. Where it is technically feasible you may request that the data be transferred directly between organisations. Once the request is made, the data should be provided to you within 30 days. This data will only contain your own personal data and any other data that could identify other people will be redacted.
Right to be informed
You have the right to be informed on the reasons we hold and process your personal data, and how long we will hold your information for. This is in the format of our Privacy Statement, that maybe updated from time to time, if there are any changes in the way we process your data.
Right to access
You have the right to request access to your data. If you can, make a Subject Access Request to the organisation in writing. Once the request is received we will respond to the request within 30 days.
Right to erasure (Right to be forgotten)
You have the right to have the information we hold on you deleted where the use of that information would no longer meet the requirements of the General Data Protection Regulation. Once the request is made, the information must be deleted within 30 days.
Where the data in question has been made public or transferred to a third party, we must also take reasonable steps to inform those third parties about the request for deletion including any links to, or copies of that personal data. The above does not apply when it is necessary to keep the data in relation to legal proceedings, to comply with a statutory obligation, or to perform tasks in the public interest.
Right To Rectification, To Object And To Restriction Of Processing
Rectification: you have the right to have inaccurate and incomplete data about you rectified and completed.
Right to object: in certain circumstances, you have the right to object your personal information being processed. Depending on the legal basis for processing, this may either be an absolute right (ie direct marketing), or may be subject to us being able to demonstrate compelling legitimate grounds which would override your own interests, or where the information is needed for the purposes of legal claims.
Right to restriction: you have the right to request that information is no longer processed (other than it being stored) in particular circumstances, such as when we are dealing with the correction of any inaccurate information; the processing is unlawful but you object to its erasure; or the information is no longer needed but you require the information to be kept for the purposes of a legal claim.
11. HOW LONG DO WE KEEP YOUR DATA
We have a Document Retention Policy in place which outlines how long we will keep different types of information for. This Policy is regularly reviewed and based around Good Practice Guidance issued by the National Housing Federation.
12. HOW WE WILL SECURE YOUR DATA
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect and hold.
Paper files and records containing personal information are kept secure. Staff are provided with guidance on secure handling of records when taken from the office – for example, when carrying out a home visit.
We ensure any information on our computer system is secure, accurate, relevant and necessary. All our computers are secured with passwords, and staff are all fully trained on our systems. The personal data held on mobile IT devices is minimised, encrypted wherever possible and technical measures taken to secure data should a device be lost or stolen.
When a tenant or housing applicant contacts us by phone, they will be asked to provide a piece of identifying data. This could be a tenancy password or reference number or application ID to ensure that personal information is only disclosed to the correct person. If a tenant would like someone else to contact us on their behalf they need to confirm that to us directly, or if it is an ongoing arrangement, complete a written request.
If someone contacts us to raise a complaint on your behalf we will always seek your permission first. This is because in responding to the complaint, the person claiming to represent you might view some of your personal data.
If you want to make an enquiry about your rent, eg your payment history or the balance of your account, we will ask you to quote to us your ‘Tenancy Password’. Every tenant has the option to create a password. If you do not know your Tenancy password we will ask for your full name and date of birth before giving you any details about your rent account. We may include other security questions to ensure your data is not disclosed to unauthorised persons.
13. DATA PROTECTION IMPACT ASSESSMENT
A Data Protection Impact Assessment (DPIA) is a process to identify and minimise the data protection risks of a project that may be undertaken by Eden Housing Association.
An Assessment will be carried out on all projects that could result in a high risk to individuals’ personal data. Any projects deemed high risk will be assessed and passed to the Data Protection Officer before making a decision on whether the risk can mitigated to ensure safety of data. If there is no way to mitigate or reduce the risk accordingly the process will not go ahead, therefore ensuring personal data is kept secure and safe.
14. ACCESSING YOUR PERSONAL INFORMATION
General Data Protection Regulation gives you a number of rights in relation to your personal information. You can find out more about your rights, and get further guidance, on the Information Commissioner Office’s website. http://www.ico.co.uk/
You have the right to access files or other records containing information relating to:
- Your present tenancy
- Your past tenancies
- Proposed tenancies
- Support Plans
15. CONTROLLING YOUR PERSONAL INFORMATION
You may choose to restrict the collection or use of your personal information in the following ways:
- You may change your mind at any time if you have previously opted into a direct marketing, if you wish to be removed from this please contact us and let us know and we will ensure you are removed from any lists (please see ‘How to contact us’ section).
- We may use your personal information to send you promotional information about third parties which we think you may find interesting where you have given us your consent to contact you with such information.
- You are entitled under data protection legislation to request a copy of any personal information which we hold about you. Such requests should be made in writing (please see ‘How to contact us’ section).
- If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible (please see ‘How to contact us’ section).
Please note the following important information about accessing your personal information:
- You can make your request in writing. All requests are passed by staff to our Data Protection Officer to ensure we act in accordance with the General Data Protection Regulation.
- To help us respond, please be as specific as you can be about the information you would like to see.
- Under the legislation, we have up to 30 days from the date you request the information to provide it to you.
- You have the right to ask us to delete or change any inaccurate information held on our files. We consider all requests and will change or delete information that we agree is inaccurate.
Because we also need to respect the rights of others, we cannot make the following information available to you:
- Information relating to, or identifying a third party, unless that person has given their written permission
- Information from other agencies such as Social Services, doctors or lawyers which could reasonably be expected to be treated as confidential
- Information that could cause physical or mental harm
The decision to refuse an individual access to personal information about themselves is taken at ‘Manager’ level within the Association, in liaison with our Data Protection Officer.
We will identify ourselves and provide a contact number for you to confirm our identity on request when contacting you about our services.
If at any point you believe the information we process on you is incorrect you may request to see this information and even have it corrected or deleted. If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter.
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO). The ICO contact details are available on its website at www.ico.org.uk
The Data Protection Officer is responsible for handling queries surrounding your data, please see the ‘How to Contact us’ Section.
16. HOW TO CONTACT US
If you wish to contact us either to change the way in which you receive communications from us; or to request further information in relation to this Privacy Statement, or you wish to be provided with copies of the data we hold, you can contact us in one of the following ways: