Privacy Policy

Habinteg Housing Association is a controller of personal information for the purposes of the General Data Protection Regulation (GDPR).  Our contact details for data protection purposes are as follows:

Jamie Burrows, Risk and Compliance Manager, Habinteg Housing Association, Holyer House, 20-21 Red Lion Court, London, EC4A 3EB 

Purpose of Privacy Policy

This Privacy Policy tells you what to expect when Habinteg Housing Association processes personal information.  It applies to personal information about applicants, tenants and other customers. It tells you the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information)

How we use your data – Tenants and Housing Applicants

Why do we collect and store personal information?

We need to collect, process and store personal information about you and other household members (when you provide information about household members we assume that you do so with their full knowledge and consent) in order to operate as a registered provider of housing and deliver efficient and effective services.

We use your personal information for providing services in line with tenancy agreements and to respond to your enquiries and managing our relationship with you. We will also use the information to:

• Check our services are fair and equal
• Assist residents who have told us about particular needs
• Improve the services we provide to you

Our Legal basis for processing

Habinteg has a lawful basis for obtaining personal data from tenants and applicants in accordance with GDPR in order to fulfil our contractual obligations to tenants. 

Some personal information that we collect about our applicants and tenants is classified as “Special Category” personal data, information such as health or disabilities, ethnic origins, religion, sexuality and criminal convictions.  The reason for gathering this sensitive information is: 

• To provide anonymised data returns to central government which is a regulatory requirement and something that all housing associations are required to do. 
• We will also consider your health conditions when assessing your housing need and the type of housing you require.
• Safeguarding our staff members.

Applicants and tenants can chose whether or not to provide this personal information.  Where we need to process personal information for purposes other than that defined in this privacy policy we will always ask you to complete a consent form in order to grant us authorisation. 

• We may collect the following information about our tenants under a lawful basis:
• Names and dates of birth of those in the household  
• National Insurance numbers, photographs, contact details and preferences
• Tenant demographic data (e.g. religion or belief, ethnicity)
• References from landlords, support providers or other people vouching for applicants’ suitability as a tenant
• Rent payments made
• Application or referral forms
• Responses to surveys or involvement initiatives
• Allegations of anti-social behaviour
• Correspondence to and from our residents, service users, other agencies or advocates
• CCTV images

We may apply markers to your information (for example, in relation to your support needs, health status or information to safeguard our staff) to enable us to tailor and deliver services to you. 

We use your personal information for providing services in line with tenancy agreements and to respond to your enquiries and managing our relationship with you. We will also use the information to:

• Check our services are fair and equal
• Assist residents who have told us about particular needs
• Improve our services.

This list is not exhaustive, as we hold records of most contacts we have with you, or about you, and we process this information so we can deliver services to you. Generally the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you), but we may also hold information provided by third parties where this is relevant to your housing circumstances e.g. from social workers and health professionals (such as doctors and occupational therapists).

We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact our ability to provide some services to you if you refuse to provide information that stops us from doing so.

How we manage your personal information

• We process your personal information in accordance with the principles of the General Data Protection Regulation (‘GDPR’).
• We will treat your personal information fairly and lawfully and we will ensure that information is:
• Processed for limited purposes;
• Kept up-to-date, accurate, relevant and not excessive;
• Not kept longer than is necessary;
• Kept secure.

Access to personal information is restricted to authorised individuals on a strictly need to know basis.

We are committed to keeping your personal details up to date, and we encourage you to inform us about any changes needed to ensure your details are accurate.

To help us to ensure confidentiality of your personal information we may ask you security questions to confirm your identity when you call us. We will not discuss your personal information with anyone other than you, unless you have given us prior written authorisation to do so.

Periods for which we will store your personal information

We will only hold your records during the period of our relationship with you and for a set period afterwards to allow us to meet our legal obligations including resolving any follow up issues between us.

Sharing your Personal Information

In delivering our services to tenants we will be required to share your personal information to our partner repairs and maintenance suppliers.  There may be times when we will share relevant information with third parties, including to meet legal requirements, for purposes as follows: 

Where necessary or required, we may share information as follows:

• to comply with the law (e.g. the police, Inland Revenue, Council Tax Registration Officer, Social Security Fraud Act) or a court order
• where there is a clear health or safety risk to an individual or members of the public, evidence of fraud against Habinteg, other irregular behaviour or a matter Habinteg is investigating
• in connection with court proceedings or statutory action to enforce compliance with tenancy conditions (e.g. applications for possession or for payment of Housing Benefit direct)
• where Habinteg has entered into a formal protocol with the police or a local authority department
• providing the name, address and contact number of a resident to contractors or other agents providing services on Habinteg’s behalf
• providing the name of a resident and the date of occupancy to gas, electricity and water companies
• providing information anonymously for bona fide statistical or research purposes, provided it is not possible to identify the individuals to whom the information relates
• giving the name, address and stated local connection of applicants for housing to parish councils who are partners in exceptions planning agreements for housing which gives priority to people with a local connection
• where the names and addresses of tenants are disclosed to payment system providers for the purposes of collecting rent. 
• information required by the Regulator of Social Housing when monitoring Habinteg’s activities in its capacity as the regulator of housing associations.
• to protect the vital interests of an individual (in a life or death situation)
• If your household has entered a new social housing tenancy after 1989, social housing providers are required to share your personal information with the Government for research and statistical purposes. You can read more about this in the following guidance:  core-privacy-notice.pdf [pdf] 167KB

When sharing personal information, we will comply with all aspects of the GDPR.

How we use your data – customers who order Habinteg Publications

Publications such as the Wheelchair Housing Design Guide can be ordered via our website.  To place an order we will collect information necessary to fulfil the order, this will include address, email and phone details and may involve third-parties used to process your payment (ie Paypal) to whom we would pass your details for that purpose only who are contractually required to safeguard your data. Data provided to us will not be used for any other purpose. 

How we use your data – people signing up for updates on our influencing work and joining campaigns

Those who sign-up to receive toolkit updates are asked to provide consent and will only receive email communications from us in relation to the toolkit or campaign you have expressed an interest in. 

Your rights under the GDPR

You have a number of rights under the GDPR:

Access to personal information

Under the GDPR, you have a right to ask us what personal information we hold about you, and to request a copy of your information. This is known as a ‘subject access request’ (SAR). SARs need to be made in writing (we have a subject access form you can use for this purpose), to the Risk and Compliance Manager and we ask that your written request is accompanied by proof of your identify. We have one calendar month within which to provide you with the information you’ve asked for (although we will try to provide this to you as promptly as possible).

Information will be provided free of charge, excessive or unreasonable requests may be asked to pay for the costs of providing the information.  

Rectification

If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting the Risk and Compliance Manager at the London Office. 

Erasure (‘right to be forgotten’)

You have the right to ask us to delete personal information we hold about you. You can do this where:

the information is no longer necessary in relation to the purpose for which we originally collected/processed it

• where you withdraw consent
• where you object to the processing and there is no overriding legitimate interest for us continuing the processing
• where we unlawfully processed the information
• the personal information has to be erased in order to comply with a legal obligation
• we can refuse to erase your personal information where the personal information is processed for the following reasons:
• to exercise the right of freedom of expression and information;
• to enable functions designed to protect the public to be achieved eg government or regulatory functions;
• to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
• for public health purposes in the public interest;
• archiving purposes in the public interest, scientific research historical research or statistical purposes;
• the exercise or defence of legal claims; or
• where we have an overriding legitimate interest for continuing with the processing.

Restriction on processing

You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

• You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
• You challenge whether we have a legitimate interest in using the information
• If the processing is a breach of the GDPR or otherwise unlawful
• If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

Objection to processing

You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

Withdrawal of consent

You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.

Right to data portability

The right to data portability allows you to obtain and reuse their personal data for your own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. The right only applies to personal data you have provided to us for the performance of a contract or information we have consent. It also only applies when processing is carried out by us using automated means.        

Protecting Personal Information

Personal information held by Habinteg is held securely in accordance with our data protection, confidentiality and information security policies and procedures.    

Telephone enquiries

For all tenant telephone enquiries tenant identification will be verified using questions about the tenancies and date of birth.  Written permission wiIl be required if a tenant would like someone else to contact us on their behalf.

Online services

An online tenant portal may be used to access our services or make rental payments.  Online tenant accounts are secured using a Username and Password.

Cookies

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

These cookies are used to collect information about how visitors use our websites. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.

Use of cookies by this site

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

The tables below explains the cookies we use and why.

First Party Cookies

Cookie	Type	Expiry	Linked Info	Functions
CFID CFTOKEN JSESSIONID	Persist Persist Session	2 hours 2 hours Session end	Username	When a user logs in, maintains Authentication state.
VOPECRA	Persist	Never	Anonymous	Remembers when a user has elected to accept cookies.

Third Party Cookies

Cookie	Name	Type	Expiry	Functions
Google Analytics	_utma _utmb _utmc _utmz	Persistent	2 years 30 mins End of session 6 months	These cookies are used to collect information about how visitors use our websites. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. Click here for an overview of privacy at Google.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.

To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.