Privacy Notice – Keeping Your Personal Information Safe
This privacy notice tells you what to expect when Railway Housing Association collects and uses your personal information. It applies to information about applicants, residents, employees, board trustees and any other service users. We are committed to keeping any personal information we have about you secure and confidential. We are a ‘data controller’ registered with the Information Commissioner’s Office, registration reference Z6279818.
We need to collect, use and store personal information so that we can carry out our responsibilities as a registered provider of social housing and as an employer.
The legal basis for using your personal information will be one of the following –
Contractual – in most cases we will use your personal information because you have asked us to take specific steps such as assessing your application for housing or for a job before potentially entering into a contract with you; or to meet our obligations as part of a contract with you such as a tenancy or contract of employment. This includes providing services to you if you are a resident and managing your tenancy.
Legitimate interest – in most other cases we will use personal information because it is necessary for us to carry out our responsibilities as a provider of social housing and employer, unless it would have an unreasonable impact on your rights.
Legal obligation – in some cases it is necessary so that we comply with legislation such as checking applicants’ Right to Rent in the UK, or sharing employees’ salary information with the HMRC.
Consent – we will ask for your consent to use information about your ethnic origin, sexuality, religion and health if you have chosen to give us this information. It will help us with important responsibilities such as providing appropriate services to residents, making reasonable adjustments for members of staff, and ensuring that we are providing equal opportunities. You can withdraw your consent at any time.
Vital interests – in exceptional circumstances we will use and share personal information if it will protect someone’s life
The information we collect about you will depend on the relationship we have with you and the service we provide to you We typically collect the following information –
Applicants and members of your household - names, contact details, address, dates of birth, details of your current and previous housing circumstances, income and savings, any medical conditions, and a copy of photographic identification. This is all needed to assess your application for housing and so that we can contact you in the most appropriate way to discuss your application. If you choose to tell us your ethnic origin we use this to make sure that everyone is treated fairly and has equal access to our housing. Please note that if you provide information about members of your household, you are responsible for making sure that you do so with their full knowledge and consent.
Residents – all of the above plus details of any special needs or requirements so that we can tailor our services to best suit your needs; medical details for assessing the need for adaptations to your home; details of others you are involved with such as carers or social services so that we can work with them to provide the best possible services to you; information that we need to help us to deliver effective housing management services such as dealing with reports of anti-social behaviour or complaints about our services; records of your rent account; your bank account details, depending on your chosen method of rent payments; satisfaction surveys to help us to check the quality of, and improve, our services; the repair and maintenance works carried out to your home; records of our contact with you; and, if you choose to tell us your ethnicity, religion, sexuality and any disability we use this to ensure that all residents are treated equally and fairly.
Employees and applicants for jobs – name, contact details, date of birth, education and training, previous employment history, current salary, references, performance and appraisal records, medical conditions, next of kin/emergency contact details, NI number, bank account details, pay and pension records, details of criminal convictions, vehicle details for car users, disciplinary and grievances, any close connection to another employee or Board Trustee, and your use of our information and communications systems such as emails, telephones and internet. All of this is used to help appoint the most suitable applicants and then meet our responsibilities as an employer. If you choose to tell us your gender, ethnicity, religion, sexuality and any disability we use this to ensure that there is fair access to employment and all applicants and employees are treated equally and fairly.
Board Trustees and applicants – the information you provide on your CV when applying; references; contact details; records of attendance at meetings, training and conferences; appraisals and performance. All of this is used to help us to appoint suitably skilled board trustees and to ensure that we meet governance and regulatory requirements. If you choose to tell us your ethnicity, religion, sexuality and any disability we use this to ensure that there is fair access to board membership and that all applicants and appointed board trustees are treated equally and fairly.
Criminal convictions and offences – we will collect and use information about applicants’ and residents’ criminal convictions and offences to manage antisocial behaviour, monitor fraud, and to protect the health and safety of employees and other residents; from job applicants and employees if it is appropriate due to the nature of the role so that we can assess your suitability; and from applicants for board membership to meet governance regulations.
Most of the information will have been provided by you on application forms or when we communicate with you. Other information may be collected from third parties where it is relevant to your application, tenancy, employment or Board membership. In most circumstances this will only be done with your knowledge and you may be able to object if you think it is inappropriate. We will only collect information that is needed to enable us to be an effective social landlord and employer.
Everything we do with your personal information will be in accordance with the Data Protection Act 2018 and the European Union General Data Protection Regulation 2016. We will only use it for a clearly defined lawful purpose. We will only use your personal information where it is necessary for us to perform our contact with you or in a way that might reasonably be expected as part of running the association and which does not materially affect your interests, rights or freedoms.
Access to your information will be strictly limited to those who need it to do their job and it will only be used so that we can provide and improve services as a landlord, meet our obligations as an effective employer, and our governance and regulatory requirements. We aim to keep your information up to date and ask that you tell us about any changes
We will make every effort to keep your information secure and we have put in place appropriate physical, electronic, contractual and managerial measures to protect it. Our IT systems have robust security measures to protect against external attack and unauthorised access; and we use other security measures such as passwords and encryption. Access is limited to those who need it to do their jobs.
We may ask you security questions to confirm your identity when communicating by telephone.
Your information will only be kept for a limited time, as set out in our document retention schedule, and then it will be securely destroyed. For example, the personal information of residents, employees and board trustees will be kept for 6 years after their tenancy, employment or board membership ends; cancelled applications for housing will be kept for 3 months; and the details of shortlisted but unsuccessful job and board trustee applicants will be kept for 12 months. A copy of our document retention schedule is available on request.
We will only share your information when we have a legitimate reason or if you have asked us to share it. For example –
We may share a resident’s name, address and telephone number so that repairs contractors can arrange a mutually convenient appointment, a research company can carry out a tenant satisfaction survey on our behalf, payments for water rates included in with rent charges can be paid to the water company, a debt collection agency can collect arrears of rent, or a company can mail out our newsletter or other publications; to provide a reference to another landlord; and to process rent payments; We share details of employee salaries and any other benefits with the pension fund and HMRC We share information with our professional advisers including lawyers, auditors, bankers, insurers, health and safety, HR and treasury management consultants so that we can receive specialist advice; We will provide information to the police to prevent or detect crime; to other statutory organisations such as social services who are carrying out statutory duties; and to the government and our regulator where we are legally obliged to do so.
We will share information to meet our legal obligations, in connection with legal proceedings, or to protect individuals in a life or death situation.
We will also provide statistical information for the purposes of research but this will be anonymised so that individuals cannot be identified.
When we share your information with trusted third parties who help us to provide our services, we only share the information that they need to perform the service. We have written contracts in place with them to ensure that they only use your information for the purpose we specify to them and that your information is kept securely. These trusted third parties include maintenance contractors, website hosting providers and IT system providers.
We will not sell your personal information.
We do not carry out any automated decision making or profiling. If we introduce either of these in the future, we will inform you.
We do not transfer any of your personal information outside of the European Economic Area.
1. Right to be informed You have the right to be informed about why we need your personal information and what we do with it. This is why we have published this privacy notice.
2. Right to access You can ask to see what information we hold about you. We have a ‘subject access’ form that you can use for this purpose. If there is specific information that you want to see then please give us the details (the particular matter or time period). If someone makes the request on your behalf then we will need evidence that you have agreed to this. The law allows us up to a month to provide the information to you but we will try to provide it to you as quickly as possible.
3. Right of rectification or erasure If you think that any of the information we hold about you is inaccurate you can ask us to correct it. If you think that we have information that we no longer need or have the right to process or if you want to withdraw consent for us to process it, then you can ask us to erase the information. If we have shared this information with anyone else we will take all reasonable steps to inform them about your request to correct or erase it.
4. Right to restrict processing You can ask us to stop processing your personal information if you think it is inaccurate or unlawful and you have asked us to correct or erase it.
5. Right to portability You can ask us to transfer any personal information that you have provided to us onto another organisation if the processing of it was carried out by automated means.
6. Right to object You can object to us processing your personal information if we are doing so based on our legitimate interests and you feel it impacts on your rights and freedoms.
7. Right not to be subject to automated decision making and profiling You can object to any decisions being made about you by automated processing.