We typically use your personal information to enable us to deliver services and manage your relationship with us as your landlord.
In performing our role as your landlord, Joseph Rowntree Housing Trust may use personal and sensitive information about your health, racial and ethnic origin, sexual orientation and religion to ensure our services are accessible.
We might share your data with third parties, including third-party service providers for legal reasons or to enable them to deliver services on our behalf.
We respect the security of your data and treat it in accordance with the law.
We will not collect information about you that we do not need.
1 What is the Purpose of this privacy statement?
1.1 Under data protection legislation, Joseph Rowntree Housing Trust (JRHT) is required to explain to residents why we collect information about you, how we intend to use that information and whether we will share your information with anyone else.
1.2 This statement applies to all current, prospective and former residents and other customers of our services.
1.3 This statement does not form part of any agreement or other contract to provide services.
1.4 It is important that you read this statement so that you know how and why we use information about you. It is also important that you inform us of any changes to your personal information during the time you are a resident with us so that the information which we hold is accurate and current.
2 Who are we?
2.1 Joseph Rowntree Housing Trust, a charitable housing association registered under the Co-operative and Community Benefit Societies Act 2014 (82009) and a registered Social Landlord with the Homes and Communities Agency (5079). Our address is The Homestead, Water End, Clifton, York, YO30 6WP.
2.2 The Trust is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you.
3 Our data protection officer
3.1 Our Data Protection Officer is responsible for overseeing what we do with your information and monitoring our compliance with data protection laws. If you have any questions about the personal data we hold about you or how we use it you can contact our Data Protection Officer who will make every effort to help you.
Data Protection Officer
Joseph Rowntree Foundation
40 Water End
York YO30 6WP
Or by email at: [email protected]
If you are not satisfied with our response or believe we are not complying with the law, you can complain to the Information Commissioner’s Office. Please visit the ICO website https://ico.org.uk/. Alternatively you could contact the Information Commissioner’s Officer (ICO) helpline on 0303 123 1113.
4 Why are we collecting your information?
We will not ask for any information about you that we do not need.
4.1 The information that you give us is required in order for us to provide you with our services in accordance with any contract we have with you such as your tenancy agreement or lease. Without this information we may not be able to deliver the services that we are contractually obliged to provide and/or improve our services to meet current, prospective and/or former residents’ needs. Our aim is that by further understanding your individual needs, we will be able to provide an improved service.
5 Types of personal information we use
5.1 We are collecting information about you which is relevant to your contract with JRHT and/or your application to JRHT either for housing or for use of our services. This includes:
- Name and date of birth;
- contact details (such as your address, personal telephone number and personal email address);
- confirmation of your identity (such as National Insurance number);
- information about your family and others (such as dependants, next of kin and emergency contact numbers);
- information about your income and other financial circumstances;
- complaints information;
- employment status;
- your views on our services and/or why you need to access a service from JRHT;
- photographs and CCTV footage.
Special categories of personal data:
5.2 Some of the information which we collect may be special categories of personal data (also called sensitive personal data). Special categories of personal data require a higher level of protection. The special categories of personal data about you which we may collect include:
- information about your race or ethnicity, religious beliefs, sexual orientation and political opinions;
- information about your health, including any medical condition, health and sickness records;
- information about criminal convictions and offences or concerns about behaviours which may present a risk to you and others.
6 Source of your personal information
6.1 The above information which we collect about you will be obtained through a variety of sources which include:
- from you directly as part of the process of becoming a resident or as part of the process to access a service;
- from third parties as part of the process of becoming a resident or as part of the process to access a service. This will include, but is not limited to:
- previous landlords
- GPs and other healthcare providers
- benefits checks
- providers of other financial information in relation to your personal circumstances
- Statutory bodies such as the Police, Social Services, Local Authorities.
- Voluntary and other organisations who may be involved with your household in some way such as providing support or advice
- Mediation services
- information obtained about you in the course of your occupancy and through the provision of the services we provide; and
- call recording to our Customer Contact Centre.
7 What we do with your information
7.1 We use the types of personal data which we have listed above for the following purposes:
The process of applying for and becoming a resident (such as making a decision about an offer of a property, affordability of a property, eligibility for benefits, eligibility for services, identifying support needs);
Providing you with services, managing your relationship with us as your landlord and determining any specific service requirements (for example aids and adaptations to your home, preferred contact arrangements, religious preferences), and determining eligibility for those services;
Identifying any support you may need (for example for residents in our sheltered housing);
Dealing with complaints (such as gathering evidence in relation to any complaints made by or about you; dealing with legal disputes involving you);
Supporting you to maintain your home and manage your tenancy/part ownership in line with your tenancy agreement/contract with us and/or supporting you in making arrangements for the termination of your tenancy agreement/contract;
To support us to resolve issues and disputes which may involve you, for example use of CCTV footage;
Informing you about services we provide or are provided by others acting on our behalf;
Informing you about activities/events that are directly relevant to you such as resident involvement opportunities, annual meetings and events in your community.
7.2 We will also use the information to ensure the services we provide meet resident’s and prospective resident’s needs and to improve the services we provide to all our customers.
7.3 We may use this information on occasion in an anonymous form, to report on general information about JRHT services and residents for example the numbers of residents who need adjustments to services. The data will be anonymised and it will not be possible to identify individual residents from these reports.
7.4 We will share specific and relevant information with law enforcement and government agencies or public bodies where we are legally required to do so. Examples may include:
- The prevention or detection of crime and fraud
- The apprehension or prosecution of offenders
- The assessment or collection of tax or duty owed to customs and excise
- Sharing in connection with legal proceedings
- Sharing in relation to the physical or mental health of an individual, where disclosure is required to protect them or others from serious harm
- Research and statistical purposes. We provide the Ministry of Housing, Communities and Local Government (MHCLG) with statistical information, we report information about our lettings and shared ownership sales via the CORE (Continuous Recording) system. The information provided does not include your name or full address, but it does contain special categories of data. Please visit https://core.communities.gov.uk/ for more details.
We may also share your information with emergency services and local authorities, where this is necessary to help them respond to an emergency situation that affects you.
8 How we use your sensitive information
8.1 Some of the information which we collect will be special categories of personal data (also called sensitive personal data), such as information about your health or your religious beliefs. In addition to the circumstances set out in section 7 above, we will use your particularly sensitive personal information in the following ways:
- We will use information about your physical or mental health, or disability status, to help support you in your home and to help determine your service and accommodation needs, for example for residents of sheltered housing;
- We will use information about your religious, philosophical or moral beliefs and any of the protected characteristics or other sensitive information about you to adapt our services to meet your service requirements and/or to determine service eligibility.
8.2 We will only collect information about criminal convictions if it is appropriate given the nature of your application for rehousing/current occupancy and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the process of applying for housing with JRHT and becoming a resident. We may also be notified of such information directly by you in the course of your occupancy. We will use information about criminal convictions and offences to determine eligibility for our services and our accommodation and
8.3 We may apply markers to your information for example in relation to your vulnerability, service requirements or behaviour to enable us to deliver services to you that meet your needs and to identify any measures we may need to put in place to protect you, other residents and our staff. We will inform you if this is the case and we will regular review all such markers.
9 What may happen if you do not provide your personal information?
9.1 If you refuse to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as providing you with accommodation or a service), or we may be prevented from complying with our legal obligations or we may be unable to determine your eligibility for a service provided by JRHT or by a third party.
10 Complying with data protection law
10.1 We will comply with data protection law. At the heart of data protection laws are the "data protection principles" which say that the personal information we hold about you must be:
- used lawfully, fairly and in a transparent way;
- collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
- relevant to the purposes we have told you about and limited only to those purposes;
- accurate and kept up to date;
- kept only as long as necessary for the purposes we have told you about; and
- kept securely.
11 What is our lawful basis for using your information?
11.1 In accordance with the data protection laws, we need a "lawful basis" for collecting and using information about you. There are a variety of different legal bases for using personal data which are set out in the data protection laws.
11.2 The lawful bases on which we rely in order to use the information which we collect about you for the purposes set out in this statement will be:
- using your information in this way is necessary for us to perform the contract (such as tenancy agreement or lease); and
- using your information is necessary for us to comply with legal and regulatory obligations to which we are subject;
- using your information pursuant to our legitimate interests, or those of a third party, and your interests and fundamental rights do not override those interests;
- you have given us your consent to use your information for a particular purpose;
- we need to use your personal information to protect your interests (or someone else’s interests) in a life or death situation; or
- we need to use your personal information in the public interest.
11.3 “Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. The lawful basis on which we rely in order to use your special categories of personal data which we collect about you will be:
- it is necessary in order for us to comply with our legal obligations in our role as your landlord;
- you have provided your explicit consent to our use of your information;
- using your information is necessary in relation to the provision of health and social care; or
- less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information about residents or former residents in the course of legitimate business activities with the appropriate safeguards.
11.4 We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy.
11.5 Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
11.6 We may also process such information about residents or former residents in the course of legitimate business activities with the appropriate safeguards.
12 Sharing your information
12.1 We will share your personal information with third parties where required by law, where it is necessary to administer the contractual relationship with you or where we have another legitimate interest in doing so. There are some cases when we will share your information to support legitimate business purposes. We do this to ensure that we can meet your needs, and also to meet our health and safety obligations towards those delivering services on our behalf. This may include sharing information with our contractors and suppliers to enable them to carry out duties on our behalf or to meet contractual obligations we may have. For example, we may share information to enable our maintenance contractors to make appointments with you to carry out repairs and/or deliver services. The information you provide will not be sold, leased or rented to parties outside of JRHT
Which third-party service providers process my personal information?
12.2 “Third parties” includes third-party service providers (including contractors and designated agents) and other entities who may be asked to carry out services on our behalf. Those third parties may include organisations such as:
- Contractors/surveyors/building services organisations carrying out repairs, improvements and other building services work to JRHT properties;
- Organisations who provide a response services in addition to that provided by JRHT eg Tunstall and BeIndependent;
- Care and Support Services providers
- Other housing providers to which you may apply for re-housing
- Welfare benefit providers and organisations who can provide financial support to whom you may apply for benefits/grants/loans for example;
- Solicitors and specialist advice organisations processing applications, requests, enquiries on our behalf or at the request of a resident;
- Housing Ombudsman and other regulatory bodies either acting on behalf of a resident or JRHT;
- Emergency services in the event of an emergency.
12.3 All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
12.4 We may share your personal information with other third parties, for example with a regulator or to otherwise comply with the law.
This section specifically refers to images - photographs and videos.
13.1 JRHT often needs photographs to use in their internal communications to their staff, or to use in JRHT’s communications with residents or to illustrate what we do on our website or on social media.
When we take photographs, we will always ask residents to sign a consent form before we use them. This is so that residents are clear about how we will use the photographs now and in the future.
We will not use these photographs on our websites, in social media or in our externally facing publications, unless residents have agreed for us to do so.
We also need to store a signed consent form, so that we know for which purposes residents have consented to us using the photographs.
13.2 Photographs and consent forms will be stored securely on our IT systems and will only be available to staff who need access to them, to do their job. Photographs and consent forms will usually be deleted after two years. We may keep a small number of photographs for our office ‘archive’ e.g. to use for anniversaries or other milestones.
Photographs which are used in publications will be visible in those for the lifetime of the publication.
If a resident wishes to withdraw consent for us to use these photographs, they can contact the Data Protection Officer.
14 Transferring information outside the EU
14.1 We do not transfer the personal information we collect about you outside the EU.
15 Security of your information
15.1 We store personal information electronically and in paper form. We have put in place policies, processes and technical security solutions to protect the security of your information.
15.2 Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
15.3 We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
15.4 When you contact us, we may ask you to provide us with some information so that we can confirm your identity. If other people (e.g. family members, support workers, solicitors) act on your behalf we will take steps to ensure that you have agreed for them to do so. This may include asking them to provide us with supporting information to indicate your consent. We do this to protect you and to make sure that other people cannot find things out about you that they are not entitled to know.
15.5 Employees and third parties who have access to, or are associated with the processing of, your personal information are obliged to make reasonable efforts to safeguard it.
16 Can we use your information for any other purpose?
16.1 We typically will only use your personal information for the purposes for which we collect it. In limited circumstances we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
16.2 We may use your personal information without your knowledge or consent where such use is required or permitted by law or when it is compatible with the purpose for which we had originally stated.
17 Storing your information and deleting it
17.1 We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our Retention and Disposal policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
17.2 In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
17.3 Once we no longer need the information about you securely destroy your personal information in accordance with our Retention and Disposal policy.
18 Your rights
18.1 Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. You can make a formal Subject Access Request in writing providing proof of identity, to the Data Protection Officer at the address provided in section 3. A charge will not be made for this unless the request is manifestly unfounded or excessive. We may also apply a reasonable administrative fee if further copies are requested.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
18.2 If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Data Protection Officer, details provided at Section 3.
18.3 If any of your circumstances change please tell our Customer Services Team straightaway on 0800 5870211 in order that we can update your records.
19 Right to withdraw consent
19.1 In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our Data Protection Officer, details provided at Section 3.
19.2 Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
20 Right to complain to the ICO
20.1 You also have the right to complain to the Information Commissioner's Office (the "ICO") if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
21 Changes to this privacy statement
21.1 We regularly review our privacy statement. This statement was last updated in June 2019.
21.2 We reserve the right to update this privacy statement at any time, and we will provide you with a new privacy statement when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.