Privacy Notice
The Privacy Notice is a public document which applies to Spitalfields Housing Association Limited (SHA) to explain how the organisation collects and processes personal information in order to conduct normal business activities as a UK housing association. This Privacy Notice tells you what to expect when SHA processes personal information. It applies to information about applicants, residents and other service users. It tells you the purposes for which we may process your personal information and the legal basis for processing this information.
Who we are
SHA is a data controller of personal information for the purposes of the General Data Protection Regulation (GDPR). Our contact details for data protection purposes are as follows:
Spitalfields Housing Association
1 Canada Square
London
E14 5AB
Telephone: 020 7392 5400
Email: admin@spitalfieldsha.co.uk
The individuals responsible for data protection compliance at Spitalfields Housing Association are Uzma Anser and Saif Osmani.
Why do we collect and store personal information?
SHA processes personal information to enable us to provide social housing accommodation and services, which include:
- Letting, renting and leasing properties
- Administering waiting lists
- Carrying out research
- Administering housing and property grants
- Providing associated welfare services, advice and support
- Maintaining our accounts and records
- Maintaining and managing our employees, agents and contractors
We also process personal information using CCTV systems to monitor and collect visual images for the purpose of security and the prevention and detection of crime.
Legal basis for processing
SHA will only collect and process your personal data under the GDPR where the following conditions have been met:
- The processing is necessary for the performance of a contract we have with you;
- The processing is necessary under a legal obligation;
- The processing is necessary where we need to protect the vital interests (i.e. health and safety) of you or another person;
- The processing is necessary where we need to perform a task in the public interest;
- It is in our legitimate business interests as a social landlord to process your information. We can do so as long as we do not interfere with your fundamental rights or freedoms.
Some personal information is treated as more sensitive (such as health, sexuality, ethnic background – see footnote below for a full list1). The legal basis for processing personal information is more limited. The reasons we can use are:
- Where we need to protect the vital interests (i.e. health and safety) of you or another person;
- Where you have already made your personal information public;
- Where we or another person needs to bring or defend legal claims;
- Substantial public interest grounds;
- Where it is in line with our legitimate interests.
Any legitimate interests pursued by us, or third parties we use, are as follows:
Equal opportunities monitoring: We collect protected characteristic data such as your gender, ethnicity, and sexuality to monitor the effectiveness of our equal opportunities policy. This is important for ensuring our services do not exclude certain disadvantaged groups and helps to ensure we are an inclusive housing association.
Safeguarding purposes: We collect certain personal information to implement appropriate safeguarding measures for our residents and employees and to provide efficient service delivery and planning.
To provide adequate support: We collect information such as your employment status and access to public funds so that we can assess residents’ needs and suitability of services. This information also helps us to make appropriate adaptions to the home, to make appropriate referrals, to allow for appropriate communications, and to allow for appropriate repairs and customer care.
How we collect your information
SHA collects information from you via a variety of sources, including when you apply for one of our properties or services, complete one of our forms, when you call, write, email or meet with us or respond to a survey. SHA operates a CCTV system to provide a safe and secure environment for residents and visitors and to protect its property. We use CCTV to detect alleged anti-social behaviour or crime, monitor security of premises and breach of tenancy agreements. Recorded images will automatically be overwritten after a period no longer than 28 days. If an image/s has been stored for evidential purposes and is no longer required, it will be destroyed in an appropriate manner.
We may record phone calls for training and quality purposes.
What information we collect from you
The information we collect from you and hold on our records may include:
- Names and date of birth, proof of ID;
- Contact details so we can communicate with you by your preferred means, and keep you informed about services we offer which may be useful to you;
- National insurance number;
- Bank statements, payslips or income details required for processing your tenancy application;
- We keep financial information obtained through rent account details, including credit history and benefits information. We may use this to help resolve arrears payments and optionally to provide welfare, benefits and debt advice as a free service to help you budget and pay your bills;
- Special categories information such as race, gender, ethnic origin, and sexuality for our equality monitoring purposes. We also collect information on disabilities, vulnerabilities and special needs to tailor our service to better meet your particular circumstances and needs. We may use this information for safeguarding of staff;
- We collect your education and employment details to use for our training and employment services;
- We record health, safety and security details.
This is not an exhaustive list as we hold records of most contacts we have with you, or about you, and we process this information so we can deliver services to you. Generally the information we hold will have been provided by you (on application on enquiry forms or when we communicate with you), but we may also hold information provided by third parties where this is relevant to your housing circumstances.
How we manage your personal information
SHA processes your personal information in accordance with the principles of GDPR. We will treat your personal information fairly and lawfully and we will ensure that information is:
- Processed for limited purposes;
- Kept up-to-date, accurate, relevant and not excessive;
- Not kept longer than is necessary;
- Kept secure.
Access to personal information is restricted to authorised individuals on a strictly need to know basis. We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate. SHA uses a range of IT systems to store personal data and we maintain these to ensure they are secure and to comply with GDPR standards. All data is held within the UK.
How long we store your personal information
SHA will process personal data for the duration of a relationship between SHA and the ‘data subject’ and will store the personal data for a minimum of 6 years after tenancy termination or the end of a relationship between SHA and the ‘data subject’.
Who we may share your information with
We sometimes need to share the personal information we process with the individual themselves and also with other organisations. Where this is necessary we are required to comply with all
aspects of GDPR. Requests from outside organisations for information about residents must be in writing unless there are good reasons for the matter to be dealt with orally e.g. an urgent request from the police where somebody’s health or safety is at risk. Such situations will be rare and SHA will use its discretion to consider where such disclosure would be appropriate in the circumstances. SHA will ensure the safeguarding of its residents’ rights is considered when approached by an outside agency with a request for information.
The following is a list of the types of organisations we may need to share some of the personal information we process with for one or more reasons:
- Family, associates and representatives;
- Suppliers and service providers;
- Financial organisations;
- Central government for housing benefits, universal credit, social services, and housing options;
- CORE (COntinuous REcording of Lettings and Sales in Social Housing in England);
- Other housing associations or trusts;
- Health authorities;
- Health and social welfare organisations;
- Security organisations;
- Charities and voluntary organisations;
- Police forces;
- Food banks;
- Courts and tribunals;
- Employment and recruitment agencies;
- Credit reference agencies;
- Debt collection agencies;
- Other social landlords;
- Capita;
- PSC Systems;
- Our contractors.
Your rights
Under the GDPR, you have the right to ask us what personal information we hold, and to request a copy of this information. You can email your request to us at admin@spitalfieldsha.co.uk. We will charge a non-refundable fee of £25.00 per request, payable in advance, to cover the cost of providing the information. We have one calendar month within which to provide you with the information you have requested for. Following your request, we will provide you with a copy of the information we hold that relates to you. This will not generally include information that relates to your property such as repair logs or details of contractor visits as this is not considered personal information.
You have the right to correct any mistakes contained in the information we hold about you. Please advise us of any changes or corrections by contacting us at admin@spitalfieldsha.co.uk or by using the ‘inform us of change’ online form via the SHA website.
You also have the right to:
- In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
- Object to processing where we say it is in our legitimate business interests, unless we can show there is a compelling legitimate reason for the processing;
- Restrict us from processing your personal information.
The right to complain and the ICO
You have the right to complain about any matter relating to our service, including how we use your personal data. In the first instance, please contact us by email at admin@spitalfieldsha.co.uk.
You have the right to complain to the ICO if you think we have breached the GDPR. You can contact the ICO at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF / 0303 123 1113 / http://www.ico.org.uk/