Privacy notice for Concept Housing Association

Identity and contact details of controller

Concept Housing Association (“CHA”) is a controller of personal information for the purposes of the UK General Data Protection Regulation (‘UK GDPR’)1. Our contact details for data protection purposes are as follows:

CHA Data Controller
T: 0121 455 7333
E: info@concepthousing.co.uk
W: www.concepthousing.co.uk
8 Greenfield Crescent, Edgbaston, Birmingham B15 3BE.

We have recruited a talented team of individuals who are all committed to our vision and empowered to take action. Our high number of positive word-of-mouth referrals demonstrates the confidence that our partners have in our ability to deliver. Our whole process is underpinned with robust compliance and friendly, helpful communication, making working with us an entirely new concept in housing.

1. By this we mean the UK GDPR as supplemented and amended by the Data Protection Act 2018

Purpose of this Privacy Notice

This Privacy Notice tells you what to expect when CHA processes personal information. It applies to information about applicants, residents and other service users. It tells you the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information).

Information we may hold about you and how we use it

The information we hold on our records concerns our relationship with you. For example:

• We hold names & dates of birth, photographic ID and information about your previous housing circumstances to assess housing applications and help prevent tenancy fraud.
• We hold contact details for you so we can communicate with you by your preferred means, and keep you informed about services we offer which may be useful to you.
• We record information about your needs (for example if you have a carer or social worker; if you need adaptations in your home; if you need large print or translated text) to ensure that we take account of any support needs in our dealings with you, and to improve our communications with you.
• We record information to enable us to provide housing management services. For example we record reports of anti-social behaviour; complaints; change in circumstances (for example when your employment status changes etc.) and information about housing options (e.g. if you have a medical need which means you need to move).
• We keep financial records about the amount of money you have paid us; any amount(s) outstanding and action taken to recover money you owe.
• We may hold information about you if you are engaged with any additional guidance and support services. For example, in connection with access to training and employment we may hold information about your job history and skills and experience, or if we support you to improve your financial circumstances, we may hold information about your household income and expenditure.
• We may record your telephone calls to our switchboard. Any call recordings will be held in accordance with our retention policy before being erased.
• We may capture your image on our CCTV systems if you visit a property, office or community facility. Any CCTV recordings will be held in accordance with our retention policy before being erased.

This list is not exhaustive, as we hold records of most contacts we have with you, or about you, and we process this information so we can deliver services to you. Generally the information we hold will have been provided by you (on application or enquiry forms or when we communicate with you), but we may also hold information provided by third parties where this is relevant to your housing circumstances e.g. from social workers and health professionals (such as doctors and occupational therapists).

We will only ask for personal information that is appropriate to enable us to deliver our services. In some cases you can refuse to provide your details if you deem a request to be inappropriate. However, you should note that this may impact our ability to provide some services to you if you refuse to provide information that stops us from doing so.

Your rights under the UK GDPR

You have a number of rights under the UK GDPR:

Access to personal information
Under the UK GDPR, you have a right to ask us what personal information we hold about you, and to request a copy of your information. This is known as a ‘subject access request’. We will provide the information you have asked for without undue delay and within one month (unless extended). We may rely on an exemption to restrict disclosure of some information.

Rectification
If you need us to correct any mistakes contained in the information we hold about you, you can let us know by contacting us on the details provided at the commencement of this notice.

Erasure (‘right to be forgotten’)
You have the right to ask us to delete personal information we hold about you. You can do this where:

• the information is no longer necessary in relation to the purpose for which we originally collected/processed it
• where you withdraw consent
• where you object to the processing and there is no overriding legitimate interest for us continuing the processing
• where we unlawfully processed the information
• the personal information has to be erased in order to comply with a legal obligation

We can refuse to erase your personal information where the personal information is processed for the following reasons:

• to exercise the right of freedom of expression and information;
• to enable functions designed to protect the public to be achieved e.g. government or regulatory functions
• to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
• for public health purposes in the public interest;
• archiving purposes in the public interest, scientific research historical research or statistical purposes;
• the exercise or defence of legal claims; or
• where we have an overriding legitimate interest for continuing with the processing.

Restriction on processing
You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

• You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy);
• You challenge whether we have a legitimate interest in using the information;
• If the processing is a breach of the UK GDPR or otherwise unlawful;
• If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

Objection to processing
You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

Withdrawal of consent
You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.

Right to data portability
The right to data portability allows you to obtain and reuse your personal data across different services. It allows us to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. The right only applies to personal data you have provided to us where the reason we are relying on to use the information is either your consent or for the performance of a contract. It also only applies when processing is carried out by us using automated means.