Privacy Notice

What information do we collect?

Information we may collect about you may include (but is not limited to):

• Name
• Address
• Telephone numbers
• Email addresses
• Date of birth
• National insurance number
• Bank details
• Identification Documents
• Income and expenditure
• Next of kin details
• Health data
• Criminal history
• Computer IP address

How do we collect your information?

We may also collect information from other third parties which includes (but is not limited to):

• Family and household members
• Friends and visitors
• Referees
• Land Registry
• Members of public
• Representatives
• Development Management Companies
• Contractors
• Complainants

Why do we need your personal information?

We may need to use some information about you to:

• deliver tenant or landlord services and support;
• manage those services we provide to you;
• prevention/detection of crime/fraud;
• help investigate any complaints you have about your services;
• check the quality of services and deliver service improvement;
• to help with research and planning of new services.

How the law allows us to use your personal information

There are several legal reasons why we need to collect and use your personal information. Generally, we collect and use it where:

• you are entering or have entered into a contract with us
• you, or your legal representative, have given consent
• it is necessary to protect someone in an emergency
• it is required by law
• you have made your information publicly available
• it is necessary for legal cases
• it is necessary for archiving, research, or statistical purposes

Consent and Your Preferences

We may contact you or send communications to tell you about our existing service to you e.g. service enhancements, government entitlements, or health and safety information. We won’t need your consent to communicate with you this way because we have assessed that it forms part of our agreement with you and it is of mutual interest for us to keep you informed and is relevant to your contract with us.

What you can do with your information

The law gives you a number of rights to control what personal information is used by us and how it is used by us.

Under certain circumstances, you have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• Object to processing of your personal data in particular ways, including processing based on the lawful basis of legitimate interests and direct marketing.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to yourself or another party in a safe and secure way, without affecting its usability, for example in a format that is structured, commonly used, and machine-readable.

To contact us about any of these rights, you can write to us at the following address:

Who do we share your information with?

We may at times need to share this information. We will only do this if we have your consent or if there are legal requirements for us to do so. We won’t ever sell your personal information to anyone else.

We use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements, there is always an agreement in place to make sure that the organisation complies with data protection law.

We are likely to share your personal information with the following:

• Property Service Companies and Maintenance Contractors
  For the purposes of carrying out property related services, inspections and repairs. Generally, we will only share your name, the property address and your contact details so that they can arrange an appointment with you. In some cases, we may also share customer service information with them, for example where you have told us that you need longer to answer your door. We may also need to share information where we have recorded there is a potential risk to operatives or other representatives.
• Local Authorities and Licensing Schemes
  Usually for the purposes of providing services processed by that local authority such as local housing allowance and council tax, or for compliance with landlord licensing schemes.
• Police
  For the purposes of preventing or detecting a crime or fraud.
• Safeguarding, Support Agencies and Charities
  We will only share information with these organisations where we suspect there may be safeguarding or welfare concerns. We will usually try to gain your consent in advance, but we may make a safeguarding referral without consent in situations where we feel there is a significant risk.
• Utility companies and local authorities
  To ensure utility services and council tax to the property are correctly charged. We may also share your personal data with Utility Management Companies who help us manage setting up accounts with utility companies and local authorities.
• Debt Recovery Agents, Tracing Agents, Legal Services and Partners
  For the purposes of recovering any outstanding charges, or for preparing or defending a legal claim.
• Places for People Group companies
  We may share your information with shared service functions within the Places for People Group, such as for tenancy enforcement.
• Development Freeholders and Management Companies
  To help manage the services we provide to you or to comply with the head lease. E.g. we will tell them the name and age of our tenants to evidence compliance with any age restrictions. We will also confirm landlord contact details with them upon completion of any sub-lets.
• HMRC
  We may share your information with HMRC where required to do so. E.g. informing them of overseas landlords.
• Tenancy Deposit Schemes
  We will share your information with a government approved Tenancy Deposit Scheme where required by law.
• Landlords/Tenants
  We may share any tenant information we hold with their landlord. This includes references, property inspections, correspondence, payment history and any general notes relating to the conduct of a tenancy. We will share the landlord’s name and address with tenant.

Where there is a high risk to your personal information we will complete a privacy assessment before we share personal information to make sure we protect privacy and comply with the law.

Sometimes we have a legal duty to provide personal information to other organisations, this is often because we need to give that data to the police, courts, local authorities or government bodies.

We may also share your personal information when we feel there’s a good reason that’s more important than protecting your privacy. This doesn’t happen often, but we may share your information:

• in order to detect and prevent a crime and fraud; or
• if there are serious risks to the public, our staff or to other professionals;
• safeguarding of vulnerable individuals
• to protect adults who are thought to be at risk, for example if they are frail, confused or cannot understand what is happening to them

If we’re worried about your physical safety or feel we need to act to protect you from being harmed in other ways, we’ll discuss this with you and, if possible, get your permission to tell others about your situation before doing so.

The risk must be serious before we can override your right to privacy. We may still share your information if we believe the risk to others is serious enough to do so. There may also be rare occasions when the risk to others is so great that we need to share information straight away.

If this is the case, we’ll make sure that we record what information we share and our reasons for doing so. We’ll let you know what we’ve done and why if we think it is safe to do so and will not cause harm, distress or further risks to you, our staff, other professionals and/or the public.

Where is your information held?

Most personal information is stored on computer systems at our head office in the UK. But there may be some occasions as our technology services progress where your information may leave the UK if it’s stored in a system outside of the EU. E.g. internet-based email servers.

We will always have additional protections on your information if it leaves the UK and ensure that we have a robust contract in place with that third party to ensure they process your data in compliance with General Data Protection Regulations.

How do we protect your information?

We’ll do what we can to make sure we hold records about you in a secure way, and we’ll only make them available to those who have a right to see them. Our security measures include encryption, anonymisation, access controls, staff security training and regular system testing and security patching.

How long do we keep your personal information?

There is often a legal or a contractual reason for keeping your personal information for a set period. We will keep your information for the duration of providing a service or product to you under the terms of a contract, such as your tenancy agreement or management contract. When your contract has ended we will keep your personal data for a set time for auditing and reporting purposes and for legitimate interest’s purposes, after that time we will either anonymise or destroy your information.

How to tell us of a data breach

Girlings Retirement Rentals Ltd and Places for People Group takes responsibility to protect the personal information we hold about those with whom we work seriously.

If you suspect your personal information or that of others may have been at risk of a data protection breach, please use this link to report it: http://bit.ly/2z64y1T

Where can I get advice?

If you have any questions about how your personal information is handled, please contact our Data Protection Lead at data.protection@girlings.co.uk.

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Tel: 01625 545 745 alternatively, visit ico.org.uk or email casework@ico.org.uk.