Privacy Notice for Tenants [HTML]

We have added this section to let you know how we are processing your personal data in response to the outbreak of Coronavirus (COVID-19).

We may ask you to tell us if you are self-isolating or have been diagnosed with the virus. For example, if you are asking us, or one of our repairs contractors, to visit your property.

We will only use this information for the purposes of ensuring the health, safety and wellbeing of our employees, contractors, and wider communities.

We may share your personal data, including information about your symptoms, to our contractors and any related third party.

Our lawful bases for processing your personal data:

• We are processing your personal data for the purposes of carrying out our obligations and exercising specific rights required by social protection law;
• We have a legal obligation to ensure the health and safety of our employees and contractors;
• We are processing your personal data for a substantial public interest;
• We may process your personal data for your vital interest and you are not able to provide consent.

We won’t disclose this information to anyone else unless it is necessary to do so to comply with any of our legal obligations, or where there is a substantial public interest to do so. For example, we may have to approach Public Health Wales, or another relevant statutory body, for advice in some instances.

Cardiff Community Housing Association is committed to respecting your privacy and ensuring the personal information you have entrusted to us is processed in accordance with the Data Protection Act 2018, the Privacy & Electronic Communications Regulations 2003, the General Data Protection Regulation, and any other applicable data protection legislation (“Data Protection Law”). 

These laws are there to strengthen your rights and give you control over the personal data that organisations hold about you.

We collect personal data regarding your tenancy either directly from you, the local authority, homeownership/direct sale, through our engaged contractors and third parties, and when you register for MyAccount.

We also collect personal information when you report:

• Tenancy-related issues
• Repairs
• Anti-social behaviour (ASB)
• Fly tipping
• Compliments and complaints

We also collect personal information through CCTV.

Most of the personal information that we process is information that you have given to us about you and the people who live with you. This includes, but is not limited to:

• Name, address, date of birth, National Insurance number, address, email address, telephone numbers, tenancy reference, personal reference
• Next of kin – name, address, contact details
• Financial profiling
• Rent details
• Diary entries of actions and conversations
• Tenant profiling details
• Gender, age, disability, ethnicity, marital status, sexual orientation, gender reassignment, religion, language
• Details of occupants living at the property including details of children: name: gender, date of birth, relationship to tenant
• Behaviour indicators
• Personal Attributes – Vulnerabilities and language preferences
• ASB database
• Complaints
• Repairs
• Information gathered by our Switchee Smart thermostat devices (please see Switchee’s Privacy Notice for more details: Switchee Privacy Policy | Switchee Smart Thermostat)
• Cookies when you visit our website

In addition to the above, when we deal with antisocial behaviour cases we may process information relating to criminal convictions or allegations. Sometimes we process personal information about you that we’ve been given by other organisations such as the local authority or the police. This could include, for example, information relating to:

• Housing applications
• Housing benefit claim
• Support package

The organisation would only share this information with us, though, where either you have given them permission to do so or the law allows them to do so.

We process your personal information, including any special categories of personal data, in connection with managing your tenancy. This could include, but is not limited to: 

• Fulfilling your tenancy agreement with us; 
• Dealing with any housing applications; 
• Dealing with any antisocial behaviours incidents; 
• Dealing with any insurance claims; 
• Dealing with any complaints and appeals. 

Under Data Protection Law, we must have a legal basis for processing your personal information. 

We will process your personal data under the following legal bases: 

• We will process the majority of your personal data for the performance of a contract (your tenancy agreement with us) and to enable us provide services to our tenants and other residents. 
• We will process some of your personal data under our legitimate interests as a social housing landlord, such as undertaking periodic surveys. We may use your comments provided from these surveys in our internal and external communications, however you will always be anonymised if so. 
• We have a legal obligation to share your personal data with certain third parties, such as for a legal claim or to fulfil our statutory obligations. 
• We may ask for your consent to process your personal data, such as asking to take photographs of you at our events. 
• We may process your personal data under a vital interest in order to protect yours or someone else’s life.

If you did not share the personal data with us, we would not be able to provide you with a tenancy, and ongoing support during the tenancy. In our ongoing relationship with our tenants, we may need to communicate with you as a business for example, when you help us with a survey that we undertake in order for us to improve the service that we provide. 

Data Protection Law recognises some information as ‘special category data’. Data Protection Law defines special category data as: 

• personal data revealing racial or ethnic origin; 
• personal data revealing political opinions; 
• personal data revealing religious or philosophical beliefs; 
• personal data revealing trade union membership; 
• genetic data; 
• biometric data (where used for identification purposes); 
• data concerning health; 
• data concerning a person’s sex life; and 
• data concerning a person’s sexual orientation. 

We will always treat any special category personal data we process with the greatest care. We will process the information in accordance with Data Protection Law. 

When processing special category personal data, our legal basis for doing so will either be one of the following: 

• further to obtaining your explicit consent to do so 
• the processing is necessary for the purposes of carrying out our obligations and exercising specific rights required by social protection law 
• the processing is in your vital interest and you are not able to provide consent 
• the processing is carried out in the course of our legitimate activities with appropriate safeguards. 
• our processing relates to personal data which has been manifestly made public by you 
• our processing is necessary for the establishment, exercise or defence of legal claims or processing is necessary for archiving purposes in the public interest. 

In order to manage your tenancy, we have to share your personal information with other organisations or local authority. This includes but not limited to contractors working for Cardiff Community Housing Association; organisations like the local authority, to allow them to process any claims for housing benefit that you might make or to provide a service to you: or the Police and other agencies for the purpose of crime prevention or detection.

We will only pass your information if you consent for us to do so, where there are laws that allows us to do so, or it’s necessary for us to do so in order for us to manage your tenancy.

We monitor information security compliance and have written Data Protection Agreements which obligate our third party providers to process your personal information only on our instructions and in accordance with applicable data protection and privacy laws.

Much of the personal data that we process at Cardiff Community Housing Association is held electronically, and most of this is held in our offices in Cardiff. Some of our computer systems store the information offsite and, when they do, we work closely with the software providers to make sure that information is stored in accordance with the requirements of the General Data Protection Regulation. 

We make every effort to ensure that your personal data is not transferred outside of the UK. If we have to transfer your personal data outside of the UK, we will only do so if: 

• the country the personal data is transferred to is covered by an ‘adequacy decision’; 
• there are ‘appropriate safeguards’ in place as defined in Data Protection Law, or; 
• an exception applies under data protection law. 

Cardiff Community Housing Association will only keep your personal data for as long as it is required and in accordance with statutory requirements. For example, we keep personal data regarding tenancy for 6 years after the tenancy has ended. Where the information is no longer required, we will ensure that it is disposed of in a secure manner. 

Under data protection law, you have the right:

• To request in writing and securely obtain copies of the personal information Cardiff Community Housing Association holds about you.
• To correct or update your personal information processed by Cardiff Community Housing Association.
• To delete your personal information processed by Cardiff Community Housing Association.
• To request Cardiff Community Housing Association to stop processing your personal data where there is no legal requirement for continued processes.
• The right to lodge a complaint with the Information Commissioners Office.

Please contact us if you wish to raise a concern about Cardiff Community Housing Association’s handling of your personal information, or compliment what you think we have done well.

You also have the right to lodge a complaint with the information Commissioner’s Office about how we manage your data like can be found here:

https://ico.org.uk/make-a-complaint/

For further guidance on your rights, you may wish to visit:

https://ico.org.uk/

Cardiff Community Housing Association will review this privacy notice regularly and may update it at any time, for example, in the event of changes in law or how we operate.

Please do check our website from time to time. If there are any significant changes in the way we process your personal information, we will provide a prominent notice either on our website or send you a notification by post.