Privacy Statement

 

At Harrow Churches Housing Association (HCHA), we are committed to protecting and respecting any personal data you and your family share with us. The wording in this document reflects the requirements of the General Data Protection Regulations (GDPR) and the Data Protection Act 2018, which ensure we, and others, use your information appropriately.

 

As a charitable organisation, we will process data in line with our objects for the benefit of the communities we serve, for providing and managing social housing and providing assistance to help house people within our communities. We are responsible for making decisions about the way your information is used and this statement describes what types of data we collect from you, how we use it, how we share it with others, how you can manage the data we hold and how you can contact us. We will always give you the option not to receive marketing communications from us.

 

We will never send you unsolicited ‘junk’ email or communications, or share your data with anyone else who might. We do not sell your data to third parties, but we do work closely with contractors and partner organisations in order to provide and improve our services and to help us to meet our legal obligations and provide a fair and equitable service for all our customers.

 

This version of our Privacy Statement comes into effect on 10 March 2023 and is available on our website, HCHA.org.uk. The contents of this statement may change from time to time, so you may wish to check the statement on our website to ensure you remain content. Where possible, we will also contact you directly to notify you of these changes.

 

 

What data do we collect?

We collect data about you and members of your household when you first occupy your home or contact us for other services. We only collect data which is necessary, relevant and adequate for the purpose(s) for which you are providing it.

 

We collect data about you and your household when you use HCHA’s websites, applications and our customer service centre. We may also obtain data about you and your household from your local authority and other agencies (e.g. Health professionals, Department for Work and Pensions, etc.). Some of this data does not identify you personally but helps us to understand how you use our services and engage with us (we use this to improve our services and make them more useful to our customers). It is in our legitimate interest to ensure that the service that we provide meets the needs of our service users and their household.

 

The data we collect includes some or all of the information shown in the table below.

(Please note: HCHA reserves the right to update the contents of the Privacy Statement from time to time. Should you decide to download or print a copy, it shall be rendered uncontrolled).

 

We will also share your data in situations where we need to pass it on to manage any request or complaint you have made to us. For example, we may share details of any complaint with the Housing Ombudsman Service, the Regulator of Social Housing, our buildings insurers, the Courts or other third parties.

 

CCTV footage

HCHA operates CCTV at its office locations and at some selected housing sites where we own or manage properties in order to prevent and detect anti-social behaviour / criminal activity. We will place ‘CCTV in operation’ signs to inform you when images of you may be captured.

 

Legal obligation to provide data

We may be legally required to provide information to third party organisations – for instance, in certain circumstances we may be required to provide information about housing benefits to a local authority, address and tenancy information for the purposes of the collection of taxes, or to provide CCTV footage to the police for the purposes of detecting criminal activity.

 

When you use our online services we may record:

• The date and time you used our services,
• The pages you visited on our website and how long you visited them for,
• ‘Live chat’ records,
• Your IP address,
• The internet browser and devices used to access our sites Cookie information (for more information please see our Cookie Policy below),
• The website address from which you accessed our website.

 

 

How we use this data

HCHA will only process data that is necessary for the purpose(s) for which it has been collected, for example to consider any application for accommodation, or to respond to any query, complaint or request made by you.

You will always have the option not to receive marketing communications from us (and you can withdraw your consent or object at any time by contacting info@HCHA.co.uk ). We will never send you unsolicited ‘junk’ email or communications, or share your personal data with anyone else who might do so.

 

There are various ways in which we may use or process your personal data, including:

 

• Sharing your personal data with our recommended third party support providers, so that they can contact you about their products and services (we will, of course, give you details about these third parties before you give your permission for us to send data to them). To analyse, evaluate and improve our services so that they are more useful (we will generally use data amalgamated from many people so that it doesn’t identify you personally),
• Processing necessary for us to promote our activities and measure the reach and effectiveness of our services,
• To identify and record when you have received, opened or engaged with our website or electronic communications (please see our Cookie Policy for more information),
• To administer promotions that you enter with us from time to time and to distribute prizes,
• To contact you when your local HCHA office opens, closes, or moves premises,
• To verify the accuracy of data that we hold about you and create a better understanding of you as a customer,
• For network and information security purposes, i.e. in order for us to take steps to protect your data against loss, damage, theft or unauthorised access
• To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request),
• To inform you of updates to our terms and conditions and policies.

 

Automated decision-making and profiling

HCHA may carry out profiling in the form of software to support prioritise the work of our staff in making decisions such as rent management or through a customer portal supporting automated decisions for customers accessing services.

 

Processing is necessary for us to promote our activities and measure the reach and effectiveness of our services

• To identify and record when you have received, opened, or engaged with our website or electronic communications (please see our Cookie Policy for more information)
• To administer promotions that you enter with us from time to time and to distribute prizes
• To contact you when your local HCHA office opens, closes, or moves premises

 

Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively

• To verify the accuracy of data that we hold about you and create a better understanding of you as a customer,
• For network and information security purposes i.e. in order for us to take steps to protect your data against loss, damage, theft, or unauthorised access,
• To comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request),
• To inform you of updates to our terms and conditions and policies.

 

Legal obligation: we may process your personal data to comply with our legal requirements (e.g. to comply with the regulatory requirements of the Regulator of Social Housing, or to comply with Health and Safety legislation).

 

Vital interest: sometimes we will need to process your personal data to contact you if there is an urgent safety issue that we need to tell you about.

 

 

How do we share this data?

We do not sell your data to third parties.

 

We do work closely with our contractors and partner organisations who deliver services for us (like repairs, satisfaction surveys, and market research, etc.). Some of our contractors, such as our day-to-day repairs partners and a select few other partnering organisations providing services on our behalf, have a limited view of our systems. Generally, this will be to enable appointments to be made, or complaints and feedback to be responded to appropriately.

 

We use a secure email facility, called Mimecast, to enable details to be sent securely via email. In situations where TLS email types cannot be received by the recipient, we endeavour to ensure that emails are anonymised where possible, or personal information details are sent within a password-protected attachment.

 

How long do we keep your data?

We will not hold your personal data in an identifiable format for any longer than is necessary. If you are a customer or otherwise have a relationship with us, we will hold personal data about you for a longer period than if we have obtained your details in connection with a prospective relationship.

 

If we have a relationship with you (e.g. you are a tenant or member of a tenants household), we hold your personal data for six years from the date our relationship ends. We hold your personal data for this period to establish, bring or defend legal claims. Where we have obtained your personal data following an inquiry or application, or a request for information on any of our services, we hold your personal data for one year from the date we collect that data, unless during that period we form a relationship with you.

 

The only exceptions to the periods mentioned above are where:

• The law requires us to hold your personal data for a longer period, or delete it sooner,
• If there are outstanding balances due to us at the end of our relationship, we will retain your data for a period of six years following the collection of all amounts owed to us,
• You have raised a complaint or concern regarding our services, in which case we will retain your data for a period of six years following the conclusion date of that complaint,
• You exercise your right to have the data erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law (see ‘how you can manage the data we hold about you’ for further information).

 

 

How you can manage the data we hold about you?

You have the right as an individual to access your personal data and make corrections if necessary. You also have the right to withdraw any consent you have previously given us and ask us to erase the data we hold about you (for information that we rely on your consent to hold it). You can also object to us using your personal data (where we rely on our business interests to process and use your personal data).

 

You have a number of rights in relation to your personal data under data protection law. In relation to most rights, we will ask you for data to confirm your identity and, where applicable, to help us search for your personal data. Except in rare cases, we will respond to you within one month after we have received any request (including any identification documents requested).

 

You have the right to:

• Ask for a copy of the data that we hold about you,
• Correct and update your data (in certain circumstances, we may request evidence of the change),
• Withdraw your consent (where we rely on it). You can do this by contacting us at info@HCHA.co.uk. in relation to any marketing messages you receive, you can unsubscribe at any time by using the unsubscribe option included in those messages,
• Object to our use of your data (where we rely on the public interest or our legitimate interests to use your personal data) provided we do not have any continuing lawful reason to continue to use and process the data. When we do rely on our legitimate interests to use your personal data for direct marketing, we will always comply with your right to object,
• Erase your data (or restrict the use of it), when we do not have any continuing lawful reason to continue to use and process that data,
• Receive copies of the data you have provided to us in a structured data file (in a commonly used and machine readable format) to transfer to another provider, where we rely on your consent to use and process your personal data or need to process it in connection with your contract.

 

You can exercise the above rights and/or manage your data by contacting our Data Protection Officer by emailing info@HCHA.co.uk or writing to:

 

Data Protection Officer, HCHA Head Office, Ground Floor, Ewart house, 9 Richards Close, Harrow, HA1 2BE

 

If you are unhappy, you have the right to lodge a complaint with the Information Commissioner’s Office, the data protection regulator in the UK. Write to them at:

 

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

 

You can call them on 0303 123 1113 or email at casework@ico.org.uk

 

 

Cookies

 

For the purpose of supplying the services of the website for yourself and future visitors, we need to collect some information from you. This is done via cookies (as you traverse the site) and HTTP headers (when you log in) where the data resides in your local storage.

 

Your consent to collect information

The ‘cookie’ consent banner on this website is your affirmative action in accessing subsequent pages where data is transmitted. Consent is based on the computer/browser/device being used. If using a shared computer it is advisable to clear local data before and after use. More information on cookies, headers, and local storage is available from Wikipedia.

 

Search https://en.wikipedia.org/ for ‘HTTP cookies’, ‘HTTP headers’, and ‘Web storage’ respectively.

 

How to withdraw consent at any time

You have the right to withdraw the consent at any time opt-out). There are various ways to do so:

 

• Disable your browser from accepting/sending cookies or saving local storage, or not using the website,
• However, there will be aspects of the website that will not function, especially the login sections.

 

As a customer of HCHA you can access your information by calling us or requesting it by post.

 

Renewal of consent

Consent will be sought each session/device or when the term(s) have changed.  If you subsequently give consent it will override any withdrawal of consent.

 

Overview cookies and local storage

Please see our privacy policy for more information on the controller and processors of data.

HCHA Head Office
Ground floor
Ewart House
9 Richards Close
Harrow
Middlesex
HA1 2BE

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect.

 

The data we collect and store	Why we collect it	The legal bases for processing	Who we share it with
Name (including title, for all household members and Next of Kin, carers or other people who can discuss the account on your behalf), date of birth, contact details and identification documents	So that we can allocate homes and services accordingly, and so that we know who is responsible for the property and who lives there (to aid in the prevention of fraud, financial crime and illegal sub-letting).	For the performance of a contract, or to assess the possibility of entering into a contract between you and HCHA (as per GDPR article 6 (1)(f)). We presume that you have gained consent of any other person’s personal details that you have provided.	Repairs contractors, Local Authority partners, or other housing provider, debt and money management advisors, utility companies, statutory organisations, third parties providing services on our behalf (such as satisfaction surveys and debt collection agencies), electronic identity verification providers, insurers (for progressing claims), the police (when necessary for the Prevention and Detection of Crime), health services (to protect your vital interests). If you are in the process of purchasing a property with us, we may share your data with legal and other professional advisors who you have instructed on the purchase.
Address (including former address(es))	So that we know which property you are responsible for	For the performance of a contract between you and HCHA (as per GDPR article 6 (1)(b))	Repairs contractors, utility providers, Local Authority partners, third parties providing services on our behalf (such as satisfaction surveys and debt collection agencies), the police (when necessary for the Prevention and Detection of Crime), health services (to protect your vital interests)
Information about any disabilities or special requirements for you and your household	So that we can allocate our services accordingly and adapt our approach to suit your needs	For the purposes of social security and protection (as per DPA Schedule 1 Pt1 and GDPR article 9 (2) (b))	Repairs contractors (only where this might have an impact on service delivery and ensure the safety of our staff and contractors), emergency or medical services as necessary
Equality & diversity information	So that we can ensure that we are providing a fair and equitable service to all of our customers, and for market research purposes	Consent	(In most cases the data will be anonymised) CORE DCLG and other Equal Opportunities Monitoring organisations
Details of transactions between you and us, including rent payments, contact (including letters, email and webchat), visit records	To ensure that your tenancy is being properly managed, and that we can ensure that we are adhering to our customer service standards	For the performance of a contract between you and HCHA	Legal advisors, insurance providers, Local Authority or other government department or housing provider
CCTV footage	For the prevention and detection of crime	DPA Schedule 9 Pt4 (5)(a))	Police, legal advisors, insurers (for progressing claims)
Photographs taken of you or your property	Monitoring Health and Safety risks and defects (when the photo is of the property) Preventing fraud, financial crime and illegal sub-letting	Legitimate interest	Legal advisors, Courts, insurers (for progressing claims) Electronic identity verification providers
Photographs taken of you or your property at events	Promoting our services	Consent	Marketing agencies or news outlets (where consent is provided)
Marketing preferences	To adapt which (if any) marketing you receive from us	Consent	Subsidiaries within the HCHA and survey providers
Payment information including bank details	To set up direct debits and process one off payments as requested by you	For the performance of a contract between you and HCHA	Our banks, Allpay, Cardsave
Call recordings	To improve our services and help train our staff	Legitimate interest (you will be advised at the beginning of the call)	Subsidiaries within the HCHA, unless you request or provide consent to share with another party
Survey / opinion data	To inform and improve the services we provide	Legitimate interest	We currently use Momentive (previously known as SurveyMonkey) as our platform for carrying out online surveys. We employ an external agency Acuity to carry out telephone research on our behalf and have a Data Sharing agreement in place. Individual record level data will never be shared externally, though on occasion we will share survey results externally in reports (e.g. our Annual Report) but only ever in aggregate form as statistics