The Wrekin Housing Group Limited (“the Group”), which includes Choices Housing Association, Old Park Services Limited and Strata Housing Services Limited, is committed to ensuring that your privacy is protected, and we will process any personal information we have about you in accordance with the terms of the General Data Protection Regulations 2016 (“the GDPR”).
Under the terms of the GDPR you have the right to be informed about the personal information we collect, what we use it for, who we share it with and how long we keep it, and this is set out below.
By completing any form on any Group site you are agreeing to our collection and processing of personal data on the basis set out in this policy.
The services we provide include: the provision of housing and other specialist accommodation; housing management and tenancy sustainment services; residential and domiciliary care; support services; debt advice and budgeting services; housing advice and assistance; training; mediation services; the provision of volunteering opportunities; room hire; furniture recycling and sale of household goods; house clearances; repairs and maintenance services; social enterprise development; and welfare benefits advice.
What we collect
We will only collect personal information we need to deliver our services and to manage your tenancy, residency agreement, licence or lease. We will ensure that the personal information we collect is updated to our systems in a timely manner, is accurate, and that it is not kept for any longer than is necessary.
How we are able to collect and process your personal information
We must set out the lawful basis by which we collect, use, retain and disclose your personal information, as well as your rights in respect of your personal information.
Where we process ‘special category data’, which includes information regarding your race, ethnic origin, political beliefs, religion, trade union membership, biometrics, physical and mental health, and sexuality we must also identify an additional lawful basis for processing.
Lawful Basis for processing personal data (including special category data) under Article 6 GDPR
- You have given consent to the processing of your personal information for one or more specific purposes – you have the right to decline to provide your consent and, if consent is provided, to withdraw it at any time.
- The processing is necessary to enter into and in the performance of a contract, for example, a tenancy agreement, licence or lease, a care contract, or a volunteering placement.
- The processing is necessary for the compliance with a legal obligation to which the Group is subject, for example, our legal obligations under the Immigration Act 2014.
- The processing is necessary for the purposes of the legitimate interests of the Group, and these interests are not overridden by your interests or fundamental rights and freedoms, for example, to prevent fraud or to collect all monies owing.
- The processing is necessary to protect the vital interests of an individual, for example, in emergency situations or where a safeguarding issue has been identified, or in the provision of a care contract.
- The processing is necessary for administering justice, or exercising statutory, governmental, or other public functions.
Lawful Basis for processing special category data under Article 9 GDPR
We will collect, process and disclose special category data where:
- You have given consent to the processing of your personal information for one or more specific purposes – you have the right to decline to provide your consent and, if consent is provided, to withdraw it at any time;
- The processing is necessary to protect the vital interests of an individual, for example, in emergency situations or where a safeguarding issue has been identified;
- The processing is necessary for the provision of health or social care or the management of health or social care services;
- The processing is necessary for the establishment, exercise or defence of legal claims or in accordance with a court order.
Lawful Basis for processing special category data under Article 10 GDPR
Article 10 applies to data relating to criminal convictions and offences, which includes alleged offences, court proceedings and sentencing.
We will collect, process, and disclose data relating to criminal convictions where:
- We have identified a lawful basis for processing under Article 6 as detailed above, and;
- You have given consent to the processing of your personal information for one or more specific purposes – you have the right to decline to provide your consent and, if consent is provided, to withdraw it at any time, or;
- The processing is necessary to protect the vital interests of an individual, for example, in emergency situations or where a safeguarding issue has been identified, or;
- Where the processing relates to personal data which is made public by you, or;
- The processing is necessary: for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings); obtaining legal advice; or otherwise necessary for the establishing, exercising, or defending of legal rights, or;
- Processing is necessary when a court is acting in its judicial capacity.
What we collect & when we collect it
We collect personal information about you at different times, in a number of different ways and from different sources. We may contact you by phone (including text messaging), email or by letter. Where we are having difficulty making appointments or engaging with you we may also use social media sites and information in the public domain to locate and engage with you.
The list below is not exhaustive as we may sometimes collect information in another way, but it gives you examples of the most common ways we collect information about you.
When you apply for a property or become a resident in our specialist accommodation.
It will be necessary for us to process the personal information we collect when you apply for, or are placed in, a property in order for us to be able to enter into the tenancy agreement, residency agreement, lease, licence or care contract (‘contract’) with you. It is also necessary for us to collect certain information when you apply for, or are placed in, a property to enable us to comply with our statutory obligations under the Immigration Act 2014, and also in order to prevent social housing or benefit fraud. The information we may collect and process when you apply for a property includes:
- Your name and contact details for use across the Group and by our suppliers and contractors;
- Personal and sensitive personal information including your age, sex, date of birth, National Insurance number, ethnicity, financial circumstances, disability, immigration status, employment status, as well as any particular needs or preferences you have so that we understand your needs and are better able to tailor our services to you;
- Personal details of your family and all others who will live with you at the property;
- The relevant documents to comply with the Immigration Act 2014 in relation to the Right to Rent. Please note that this applies to all occupants living in the property over the age of 18;
- Photo ID to keep on file so that we can be sure who is occupying the property, and to prevent social housing fraud;
- A reference from a previous landlord (if applicable);
- A credit reference check in relation to you and all those who will contribute to the rent and household expenditure with an external agency to make sure that you are able to afford the property, and also for the prevention, detection and prosecution of crime, including social housing fraud and benefit fraud.
- Bank details and direct debit information to enable you to make payments for rent, licence fees and service charges or for any other services being provided to you for which we charge;
- Information relating to welfare benefits, your income and savings to verify your circumstances or to provide advice and assistance;
- Details of anyone you have formally authorised to contact us on your behalf;
For our more specialist accommodation, additional personal information we may collect and process in order to enter into the residency agreement and care contract includes:
- Relevant care plan and risk assessment;
- Details of anyone who has Power of Attorney for you;
- Deprivation of Liberty orders;
- Medication taken;
- Court of Protection orders;
- Do not resuscitate orders.
During your tenancy, residency, lease or licence with us for housing management purposes, or where it is necessary for the purposes of our legitimate interests, we may collect:
- Up to date contact details;
- Details of benefits received;
- Any information gathered as part of any investigation in nuisance or anti-social behaviour;
- Details relating to the repairs and maintenance of your property, including feedback from our trades and contractors about their appointments with you;
- Information that you provide to the housing management team or any other contact with us. This includes any information you post on any of our social media platforms;
- CCTV recording dash cam images for safety and crime prevention. Information when you complete surveys, questionnaires, feedback forms and enter competitions;
- Details of any complaints you make and how they were resolved;
- Details of you and your family’s support needs so that we can arrange for appropriate support to be put in place (this may be with an external provider) if you ask for tenancy support;
- Details required by the insurer to be processed by us if you require us to arrange home contents insurance for you or if you have made an insurance claim against us.
- We may take pictures at residents’ parties, meetings and other events, and these may be used in newsletters, annual reports, brochures or on the website or Facebook, and they may appear in local newspapers. Whenever we take pictures we will always ask you for your written permission and give you the choice whether or not to be included in a photograph.
At the end of your tenancy, residency, lease or licence we will collect:
- Details of your forwarding address;
- Payment details for any debt that may be outstanding;
- The results of any customer satisfaction survey you have completed.
(The processing of this personal information is necessary for the purposes of our legitimate interests.)
When you receive other services from us
In order for you to receive any of the other services from us, for example, assistance with securing private sector accommodation, welfare benefits and debt advice, or for you to be able take up a volunteering placement with us, it may be necessary for us to collect and process additional personal information, including sensitive personal information, which may include the following where applicable:
- Details of when you left care;
- Any substance misuse issues you or your family members have;
- Details of any criminal convictions;
- Your income and expenditure details, including any debts you may have.
This information is usually provided by you with your consent in order to be able to receive the services.
How we will use the information we gather
We use the information to:
- Understand your needs and provide you with our advice and services;
- Maintain internal record keeping ;
- Manage your tenancy, residency, lease or licence;
- To comply with any care plans in place;
- Customise our services for you;
- Provide volunteering opportunities;
- Monitor and improve our services;
- Recover any debt owing either at the end of the tenancy, residency, lease or licence, or for services which are unpaid.
We will process your personal information where necessary for the purposes of the legitimate interests of the Group.
From time to time we may send you information to let you know of services or other accommodation we can provide which may be of benefit to you. We may also contact you for other research and monitoring purposes using your preferred method of contact. However, you are able to opt-out of receiving such materials and this will be recorded on our system. You can opt-out by phoning us on 01952 217100, by writing to us at The Wrekin Housing Group, Colliers Way, Old Park, Telford TF3 4AW, by calling in to one of our offices or shops, or by emailing firstname.lastname@example.org.
Who we share your information with during the management of your tenancy, residency, lease or licence.
We may share your information within the Group if it’s necessary for the effective delivery of services to you.
We will also share your personal information to ensure that we can meet your needs and deliver services to you, as well as comply any statutory or health and safety obligations. We may therefore share your personal information with, for example:
- Contractors who undertake repairs or improvements to your property on our behalf;
- Out of Hours call handlers who receive telephone calls when our offices are closed;
- Local authorities and other government departments who provide funding, or services to you, including benefits and Safeguarding Boards;
- IT providers who own or manage the systems we use (including phone systems);
- Banks in order to process payments through a secure system;
- Companies employed by us to mail letters, newsletters, leaflets, etc;
- External consultants or agency staff working on our behalf
- Our professional advisors and auditors;
- External agencies where you have agreed to or have requested a referral for assistance.
- Core funding partners, for example, the National Lottery & Building Better Opportunities where we have received funding or have a contract to provide the services you have received.
There may be other times when we disclose your personal information to others, for example:
- Emergency Services and the local authority where it is necessary to help them respond to an emergency affecting you or others living in the property;
- Where a data sharing agreement is in place, for example, with the police, for the prevention and detection of crime or where there is on-going anti-social behaviour;
- Debt collection agencies to deal with former tenant, licensee, care fees or service charge arrears;
- Utility companies, including water companies;
- Mortgage lenders if you are a leaseholder or have shared ownership property.
- Insurance companies (including 3rd party insurers)
We will not share your personal information with anyone who claims to represent you unless we are satisfied that you have given express authority for them to do so, or they act in a recognised official capacity.
In certain circumstances we may be legally required to share your information with third parties such as the police, government agencies, our Regulator (the Regulator of Social Housing) and other public bodies. Examples of these circumstances include:
- The prevention or detection of crime and fraud;
- The apprehension and prosecution of offenders;
- The assessment or collection of tax or duty owed to customs and excise;
- Sharing in connection with legal proceedings, including anticipated legal proceedings;
- Sharing in relation to the physical or mental health of an individual, where it is necessary in order to protect them or others from harm;
- Research and statistical purposes, for example, we are required to share information relating to your tenancy with the Ministry of Housing, Communities and Local Government. You can obtain a copy of their Privacy Notice by phoning 01952 217100 or by visiting the website https://core.communities.gov.uk/public/cookies.html
Credit Reference Agencies and Housing Partners Ltd
If you are a tenant, we will share your personal information with Experian (a credit reference agency) via a credit checking service on the Home Swapper website. We will do this when you apply for a property with us as part of our checks to ensure that you are able to afford the property you have applied for before you enter into a tenancy agreement.
The Group is also a member of Rental Exchange which is a scheme run by Big Issue Invest and Experian. The scheme allows tenants with little or no credit history, to build a credit history and to create an online proof of identity which, together with being able to show a track record of paying your rent, will enable you to access services such as bank accounts, credit cards, online shopping, cheaper credit and better gas and electricity rates.
In addition, sharing your tenancy records through Rental Exchange allows us to work more closely with you to manage your existing tenancy, and also enables Experian to use the information to assist other landlords and organisations to:
- Assess and manage any new tenancy agreements you may enter into;
- Assess how strong your financial standing is for suitable products and services;
- Manage any accounts that you may already hold, for example, reviewing suitable products or adjusting your current product in light of your current circumstances;
- Contact you in relation to any accounts you may have and recovering debts that you may owe;
- Verify your identity and address to help them make decisions about services they offer;
- Help prevent crime, fraud and money laundering.
- Scrren marketing offers to make sure they are appropriate to your circumstances;
- For Experian to undertake statistical analysis and proofing; and
- For Experian to conduct system and product testing and database processing activities such as data loading, data matching and data linkage.
There is a legitimate interest in sharing your tenancy details and rent payment history with the Rental Exchange and Housing Partners Ltd throughout your tenancy to help you access more affordable credit and to support the Group in making better informed tenancy decisions (unless you tell us you wish to opt out of the scheme by telephoning 01952 217100 or by calling into any Group office.)
If you would like to see more information and to understand how the credit reference agencies each use and share rental data as bureau data (including the legitimate interests each pursues) this information is provided in this link: www.experian.co.uk/crain (Credit Reference Agency Information Notice (CRAIN)).
If you would like advice on how to improve your credit history you can access independent and impartial advice from www.moneyadviceservice.org.uk (you can get a copy of your Statutory Credit Report by visiting www.experian.co.uk/consumer/statutory-report).
If you are unhappy with anything relating to Rental Exchange, please contact Experian via the link shown above. You also have the ability to get in touch with the Information Commissioner’s Office. More information about this can be found using this link here: https://ico.org.uk/concerns/.
How we will store your personal information
We store your personal information electronically where possible, however there maybe cases where we hold paper files. We are committed to ensuring that your personal information is secure. This means only those employees or others working on our behalf that need to see your personal information can access it. In order to prevent unauthorised access or disclosure, we have put in place suitable electronic and organisational procedures to safeguard and secure your personal information.
How long we will keep your information for
We will not keep your personal information for any longer than is necessary, and in accordance with any statutory and regulatory requirements.
Under the GDPR your rights in relation to the personal information we hold about you have been enhanced and are detailed below.
You have the right to:
- Access – you have the right to access your personal information held by us free of charge (unless your request is unreasonably excessive or repetitive). This applies to personal information about you only and does not include any joint tenant or other person living with you at the property. You have the right to make a ‘subject access request’ which is a request to us in writing, by completing the subject access request form to obtain a copy of your personal data. We must reply to your request within one month, unless there is an unusually large amount of data or we seek clarification from you about the personal data you wish to see. We will ask you for proof of your identity before we will process your request.
- Rectification – you have the right to have your personal information held by us rectified if it is inaccurate or incomplete. We have one month to reply to your request for rectification, or two months if your request is complex. If we do not take any action in response to your request we will explain why this is the case.
- Erasure – of your personal information, also known as the ‘right to be forgotten.’ However, this does not give you an absolute right ‘to be forgotten’, but it gives you the right to have personal information erased and to prevent the processing (using) of it in specific circumstances, which include:
- Where the processing of your personal data is no longer necessary;
- Where you have withdrawn consent (although we do not have to accept a withdrawal of your consent where we have legitimate reason for continuing to process your personal information);
- Where you object to our processing your personal information and there is no legitimate interest for us to continue to do so;
- Where your personal data is unlawfully processed;
- Where your personal data has to be erased in order to comply with a legal obligation.
- Object – you have the right to object to the processing of your personal information regarding:
- Direct marketing – this is where we may contact you directly to offer additional services, etc. (Please see the section above on Direct Marketing)
- Processing based on legitimate interests
- Challenge and object to a decision when it is based on automated processing.
- Portability – you have the right to be able to obtain and reuse your personal information for your own purposes across different services.
- Restrict – you have the right to restrict the processing of your personal information where:
- You dispute the accuracy of it until we have verified its accuracy;
- You have objected to the processing of your personal information and we are considering whether our legitimate interests outweigh your objections;
- You have requested restriction rather than erasure.
- Complain to the Information Commissioner’s Office. The Information Commissioner can be contacted on 0303 123 1113 or has a useful website at ico.org.uk
- Seek compensation from the Courts.
Privacy Notice & COVID-19
This addendum to the Group’s Privacy Notice and Policy explains how the Group, as Data Controller, may use your personal data in relation to the Coronavirus (Covid-19) pandemic.
Your Personal Data
This means any data which relates to a living individual who can then be identified from that data. This includes basic details such as your name, address, telephone number and email address. However, some of your personal data will be sensitive or ‘special category’ personal data, for example, your age, health, ethnicity and vulnerability data.
Although we may have collected your personal data previously for specific purposes, as a result of the challenges posed by Covid-19 and the rapidly changing situation, we may process this personal data for different purposes. For example, in order to ensure your safety and the safety and well-being of others, including our employees and contractors who may need to come into your home to provide an essential service. We may also process your personal data to signpost you to specific support providers.
Where you haven’t previously provided it, we may also ask you for sensitive personal data, for example, if you or other members of your household have any underlying health issues, symptoms of Covid-19, or any particular vulnerabilities we are not already aware of.
We need this personal data to be able to deliver our essential services effectively, to keep people safe, to safeguard the vulnerable and those in identified ‘high-risk’ categories, to help business continuity, and to assist the government in containing the spread of Covid-19. We may also obtain this information from a third party.
However, we will limit the collection and processing of your personal data to that which is proportionate and necessary and we will follow the latest guidance issued by the Information Commissioner’s Office (link below) and health professionals.
Sharing your Personal Data
During this pandemic when it is necessary to do so, we may share your personal data with the local authorities in the areas in which we operate, the emergency services and other stakeholders, but we will do so in a proportionate and secure manner and in accordance with the relevant legislation.
Our contractors are obliged to comply with the legislation and our Confidentiality Agreement or relevant data protection clauses in their contract in order for personal data to be managed appropriately and for specified purposes.
As explained below, we will not be required to contact you to obtain your consent prior to sharing your personal data.
The ‘Legal Bases’ for sharing your personal data as a result of Covid-19
Under the General Data Protection Regulations 2016 (“GDPR”) and the Data Protection Act 2018 (“DPA”), we are able to share personal data for a variety of reasons. Both the GDPR and the DPA contain provisions to enable information sharing in times of an emergency, such as we are in now. The relevant provisions are detailed below.
Article 6 of the GDPR – Lawfulness of Processing
- Article 6.1 (c) - processing is necessary for compliance with a legal obligation to which the controller is subject
- Article 6.1(d) - processing is necessary in order to protect the vital interests of the data subject or of another natural person
- Recital 46 adds, “The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person……. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread…”
- Article 6.1 (e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Article 6.1 (f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party
- The processing of sensitive or special category personal data requires that an additional condition is met in order for it to be lawful. These are detailed below.
- Article 9.2(c) - processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
- Article 9.2 (g) – processing is necessary for reasons of substantial public interest
- Article 9.2(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
- Article 9.2 (i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care.
- Schedule 1, Part 1 DPA – processing is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, for example, the Health & Safety at Work Act 1974.
- Schedule 1, Part 1 (3) DPA – processing is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, for example, directives from Public Health England.
Our ongoing obligations in relation to the storage, retention and security of your personal data remain unchanged as do your rights in relation to your personal data.
Changes to our Privacy Notice
This Privacy Notice may change from time to time, and we will display any updated notice on our website.
Other sites with useful information include:
ICO: Information Commissioner's Office
Government website - privacy and cookies
Ministry of Housing, Communities and Local Government Privacy Notice