Privacy Notice for Housing Applicants, Residents and Users of CCHA website
This privacy notice explains how Castles & Coasts Housing Association (CCHA) collects and uses personal data for:
Housing Applicants
Residents
Users of CCHA website
This notice applies if you’re a tenant, customer, or use any of our services, visit our website, email, call, social media messages or write to us, or visit us in person.
Who we are
CCHA is a Registered Social Housing Provider, registered under the Co-operative and Community Benefits Society Act 2014 (company number RS007617) with registered office at 3 Paternoster Row, Carlisle, Cumbria CA3 8TT.
For the purpose of the Data Protection Act (2018) CCHA is registered as a data controller with the Information Commissioners Office with registration number ZA268880.
CCHA’s Data Protection Officer is contactable by the following methods.
Address – 5 Paternoster Row, Carlisle, Cumbria CA3 8TT
Telephone - 0800 085 1171
Email - gdpr@castlesandcoasts.co.uk
What does this privacy notice apply to?
This Privacy notice applies to information that we collect from or about our tenants, residents, customers and visitors to our premises, websites, platforms or portals.
We collect information via:
The CCHA website and mobile site
Our wireless networks
Customer call centres/Out of Hours providers/Contractors
Application forms
Landlord references
Financial checks
Employment Contracts
Employer/Character references
Disclosure and Barring Service (DBS) checks
Local Authority and Health Services
Police and Courts
Tenancy / Leaseholder Agreements
Personal interviews
Surveys
User groups and community events
Residents
Contact forms
Telephone conversations
Emails
Verbal, written and visual messaging and social media platforms including o Facebook;
o LinkedIn;
o Messenger;
o Teams;
o Twitter;
o WhatsApp;
Webchats
Surveillance Camera Systems including dashcams and door entry systems
Location monitoring systems including vehicle trackers, fob entries, device locations
All systems used by the group including:
o Recruitment, HR and payroll management systems;
o Housing and Allocation systems;
o Procurement and Supplier management systems
o Risk, Health & Safety and Information management systems; and
o Invoicing and payment management systems.
In addition, we may receive information about you via third-party referrals.
CCHA will also collect equality and diversity information, including age, gender, ethnicity, religious beliefs, disability, sexuality, relationship status for our legitimate interest to monitor the equality, inclusion and diversity of our tenants, residents and ensure compliance with our policies and processes. This information is held separately, and not considered as any part of the housing application process.
Your relationship with us determines what information we collect from you.
We aim to limit the amount of information we process to that which is reasonably necessary to
provide you with our services;
respond to concerns or issues raised;
enter or remain in a contract or agreement with us; or
fulfil the requirements of a former contract or agreement.
We will not combine the information given for one purpose with other non-compatible purposes.
The types of information that we collect can be categorised as: The
Name (including any previous names), date of birth, gender, nationality, residential status, NI number, financial situation, details of criminal offences Allocation of housing (Cumbria)
Full name, current address, postcode and date of birth, gender, nationality, contact details NI number, financial situation, details of criminal offences, disabilities & medical conditions, support needs/ support worker details, household member name, DOB/age & relationship to main applicant, Current tenure type & size, landlord address and contact details, Current property type, length at current address, Allocation of housing &tenancy management & Repairs and Maintenance
If Tenant, Repairs and Maintenance contractors, Local Authorities, Utility companies, All Pay. DWP Debt recovery, police and support organisations in some instances. Tripartum, Sometimes Network Credit 6 years after offer acceptance
homeless status, housing need, pregnancy status
Location of CCTV (PIA)
Purpose of CCTV (PIA)
When and how CCTV images will be accessed (PIA)
Ways in which people are made aware of CCTV system (PIA)
Disability impact on evacuation (Flood Plan)
Time to vacate (Flood Plan)
Key holder/s (Flood Plan)
Consent for CCHA to enter property in event of a flood (flood plan)
Utility supplier details (AST)
Safeguarding/concerns/reporting forms and details from third parties
Tenancy type (AST, assignment, assured, fixed term, garage, garage plot, allotment)
Tenancy start and end dates
Severe diary entries/warning markers name, job role, company, vehicle reg, time in and time out
Name, contact details, address, health conditions, next of kin/emergency contact details
Bank account details
Bank statements
Payment method
Rent account details
Recharge Information - details of repair (what and why it’s a recharge), costs
Court costs
Outcomes of court hearings
Personal circumstances affecting rent payments
Housing Benefit details
Universal Credit details (payments, APAs) income and expenditure (including debt)
Right to Rent codes from DWP
Tenancy Management Unlikely only emergency Services in event of emergency?
Name, contact details, nature of complaint/ complaint outcome, compensation payments. Learning from complaints
Name, address and contact details
Health and Safety Repairs and Maintenance contractors, Out of Hours provider
Care Call Service Care Call Providers
Income management All Pay/CCHA Bank
Tripartum
DWP, Local Authorities, Network Credit Services, UK Search. Other landlord if reference requested. Law Centre or CAB if resident requests/consents . Social Services on a case by case basis. Solicitors, auditors
Network Credit, Tripartum,
Complaint management Housing Ombudsman if escalated by the complainant
Sale of homes Estate agent developers and development contractors
6 years Contract, Legitimate interests, Public task, Consent
Permanently Legal Obligation
8 years after end of care Vital Interests
7 years Contract, Legitimate interests, Legal obligation
6 years Legal obligation
6 years Contract
When CCHA uses a data processor to process data on our behalf, we have a written agreement in place that covers data protection, in line with the requirements of the UK GDPR.
CCHA may share your data with Care Call providers if your agreement with us includes a Care Call service. CCHA may share forwarding address of former tenants with utility companies and council tax departments. From time-to-time CCHA may collect and use additional information about you. This is on a case by case basis and you will be informed at the time any additional data is collected or shared.
In exceptional circumstances we may share your data with other external consultants or solicitors where we require specialist or legal advice.
Use of automated decision-making or profiling
The data is not used for:
automated decision making (making a decision by automated means without any human involvement)
profiling (automated processing of personal data to evaluate certain things about an individual)
Transference of your data outside of the UK
We will not transfer or store your personal information outside of the UK unless
The country that we send the information to is approved by the Information Commissioners Office as providing an adequate level of protection for personal information; or
there is a written contract in place that includes the standard contractual clauses approved by the Information Commissioners Office to make sure your data is safeguarded to the same standard as within the UK
There is an applicable exception in data protection law that applies that allows us to transfer or store the data outside of the UK.
Tracking Technology Cookies
We use cookies in order to gain an understanding of how you use our website and platforms. Cookies can contain your IP address, operating system, and browser address.
Having cookies stored on your device enables us to improve and personalise your experience, if you want to you can turn off cookies in your device's browser, however, this may impact your experience and require you to log back into certain areas on each visit.
For further information on cookies, view our cookie notice
Spamming
Spamming is where unsolicited e-mails are sent to you containing advertisements or marketing related materials without your consent.
CCHA will not send you spam emails, and we will not share your email address with third parties for them to use in this way.
If for some reason you believe you have received a spam e-mail from CCHA, please contact us at GDPR@castlesandcoasts.co.uk
Your Rights
Your data protection rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask us for a copy of your personal information.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
Please note that these rights may differ depending on the lawful basis under which we are processing your personal data. We may be entitled in certain circumstances to refuse requests or apply exemptions. You can find out more about your rights from the Information Commissioner’s Office Website
Please contact GDPR@castlesandcoasts.co.uk or in writing to Data Protection Officer, 5 Paternoster Row, Carlisle CA3 8TT if you wish to make a request.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at GDPR@castlesandcoasts.co.uk or in writing to Data Protection Officer, 5 Paternoster Row, Carlisle CA3 8TT
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address: Information Commissioner’s Office
Wycliffe House Water Lane
Wilmslow
Cheshire SK9 5AF
Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk
This privacy notice was last updated September 2023