How we use your information

We take your information very seriously.

 

Our privacy notices set out what information we collect, why we collect it, who we share it with and how we safeguard it. This varies slightly depending on the service we are providing. You can download a copy of the relevant privacy notice below.

 

Read our privacy notices to see what information we keep and how we use it.

How we keep your information safe

During your tenancy we collect lots of personal and sensitive data, and we take keeping your data safe very seriously. To accomplish this, we have our own expert teams and use a mature information security management system so that your data will be treated appropriately and won’t end up in the wrong hands. To achieve this, we use a three-layered approach: People, Processes and Technology.

 

We use a number of technology solutions to control how your data is secured and accessed. Our technology covers multiple levels of our systems to ensure we can control your data from end to end. All our users are trained in the best ways of handling personal data, are kept informed on potential threats to that data, and follow strict policies and procedures to ensure security is kept to a high level.

 

We use both internal and external independent testers and auditors to ensure weaknesses are identified and put right.

 

Rest assured, we have put a combination of approaches into place. All staff are trained before handling your data and are aware of their responsibility in relation to this.

The safety of your personal data is our top priority.

Who we share your information with

Sometimes we need to share your information with suppliers.

 

Depending on the service they provide on our behalf will determine the data we share with them.

 

Rest assured, when we share data with them, we take a number of steps to ensure your data is kept safe and secure.

 

We review this list on a weekly basis.

Access a full list of our suppliers.

How long we keep your information

Our Data Retention Schedule sets out how long we keep your information.

 

It breaks down the periods we keep data based on the type of information it is.

 

Read our Data Retention Schedule here.

We will only ever keep your data as long as we need to

Your rights

Legislation gives you certain rights regarding your data.

 

 

The right to be informed

 

You have the right to be informed about the collection and use of your personal data. When we collect data from you we provide you with Privacy notices which details:

  • The purposes for processing your personal data
  • Our retention periods for that personal data
  • Who it will be shared with

The right of access

 

You have the right to access your personal data and supplementary information. This right allows you to be aware of and verify the lawfulness of the processing. For more information about this subject download the Subject Access Request Form to allow you to see your personal data.

 

Right of rectification

 

The GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.

In certain circumstances we may refuse a request for rectification.

 

Right to erasure

 

The GDPR introduces a right for individuals to have personal data erased. It is known as “the right to be forgotten”.

The right is not absolute and only applies in certain circumstances.

 

Right to restrict processing

 

You have the right to request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances.

If we agree to your request to restrict processing we will store your personal data, but not use it, however this may impact on the services we can provide to you.

 

Right to data portability

 

This right allows you to obtain and reuse your personal data for your own purposes across different services. It allows you to move copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.

 

Right to object

 

You have the right to object to:

  • Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling)
  • Direct marketing (including profiling)
  • Processing for purposes of scientific/historical research and statistics

If you think the data we hold is inaccurate or incomplete, or you want to exercise any of these rights, you can make a request verbally or in writing, and we will respond within a month of receiving the request. You can do this by contacting our customer service centre.

You can exercise these rights at any time. If you make a subject access request we’ll respond within a month.