CUSTOMER PRIVACY STATEMENT
Shared Ownership And Leaseholder Customers
Islington & Shoreditch Housing Association Limited
- Your personal data – what is it?
Personal data means any information which relates to you or identifies you as an individual. - What type of personal information do we collect?
The following is all the types of personal information we may collect about you; however, not all of these will apply to all customers:
• Name
• Address
• Email address
• Telephone number
• Date of birth
• National Insurance Number
• Photo ID
• Nationality/Immigration status/Visa
• Bank details
• Next of Kin
• Marital Status
• Details of anyone authorised to act on your behalf
• Household make-up/no. of dependants
• Employment/employer details
• Financial details such as annual income, benefits, maintenance, savings, credit history
• CCTV images
The following is a list of special categories of personal data which we may collect about you;
• Diversity data (disability, ethnicity)
• Medical records
• Sexual orientation
We may collect this information in a variety of ways. We collect all this information when you register on the www.isha.co.uk website. We may collect information through other interactions with you, such as when you contact us. From time to time we may also contact you to confirm the information we hold about you. We may also collect personal information about you from third parties. We would normally only do this with your
permission but there are occasions when we may collect this data without your permission for example for dealing with crime and antisocial behaviour.
Your data will be stored securely in a range of places including our IT systems and in locked filing cabinets. - Who are we?
ISHA is the data controller (contact details below). This means it decides how your personal
data is used and for what purposes. - How do we use your personal data?
We may use your personal data to:
• Provide essential services – we collect information that will enable us to perform essential landlord functions such as collecting rent, providing repairs and managing your tenancy
• Contact you – we use your contact information and preferences to get in touch regarding your tenancy
• Personalise our services for you – if you or a member of your household has a disability or other vulnerability that impacts how you access our services, we may use this information to ensure the individual services we provide are accessible
• Monitor how we provide services – we regularly report on various diversity strands to identify differences in how groups of residents experience our services and ensure equal access for all residents. We also record inbound and outgoing telephone calls for this purpose and to identify training
• Meet regulatory requirements, as set out by the Regulator of Social Housing, which comes under the Department for Levelling Up, Housing and Communities - What is the legal basis for processing your personal data?
We must have a legal basis for processing any data. One or more of the following conditions need to be met to process personal data:
• Processing is necessary to perform or enter into a contract
• Processing is necessary to comply with a legal obligation
• Processing is necessary to protect the vital interests of the individual or another person
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Processing is necessary for the purpose of legitimate interest pursued by the controller or a third party, except where such interests are overridden by the interests, rights, or freedoms of the individual.
• Consent of the individual
Conditions for processing special categories of personal data:
• Explicit consent
We need to process data to enter into a leasehold agreement with you and to meet our obligations as a freeholder/head lessee. - Consequences of failing to provide data necessary for a contract
You are not obliged to provide personal data to us, however if you fail to provide data which is necessary for ISHA to carry out its freeholder/head lessee functions we may not be able to
enter into a lease agreement with you and where we already have a contract with you we may not be able to fulfil our full obligations to you under that contract. - Sharing your personal data
We will never sell your information to a third party. We do occasionally need to share your information with third parties to accomplish the goals stated above and to carry out our duties as a landlord.
Third parties with whom we may share personal information include:
• Marketing agents
• Independent Financial Advisors
• Mortgage companies
• Solicitors
• Estate agents
• Repairs and maintenance contractors
• Out of hours call centre service
• External printers, translators or survey providers
• Police
• Statutory organisations such as local authority departments
• Our Regulator, auditors and utility companies or other organisations whom we are legally allowed to.
We will only share the minimum information necessary for the contractor to carry out their services on behalf of ISHA.
We may share your data with a third party for the detection and prevention of crime or fraud. This may include personal data such as your name, address, contact details, door entry information and CCTV images. We may undertake the transfer of your personal data to countries outside of the United Kingdom, for example when a processor holds their data in the EU. When doing this, we ensure we comply with the UK GDPR's rules around international transfers. - Children’s information
ISHA does not normally process children’s information as part of a tenancy, as all tenants are adults. - How do we keep your information safe?
We understand the importance of security of your personal information and take appropriate steps to safeguard it. We have internal polices and controls in place to make sure that your data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by our employees in the proper performance of their duties. All staff who have access to your data are trained in how to use your information in a secure and
sensitive way. All hard copy personal files are kept in locked cabinets when not in use. Information on e-mails is encrypted or password protected and information in databases is password protected. We regularly review our IT provision to make ensure security and that we have is fit for purpose.
Where we engage third parties to process data on our behalf we do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data. - Automated Decision Making
We do not use automated decision making. - How long do we keep your personal data?
We keep data in accordance with our data retention policy.
We keep registration of interest records for up to a year unless:
• it is requested to be removed sooner
• it is requested we continue to keep the information for longer
• the interested party purchases on of our properties
When an applicant goes on to purchase one of our properties, we maintain all records for the duration of the lease or as long as money is owing on the account.
We maintain former shared owner records for 6 years following the termination of the lease after which all data will be destroyed, apart from basic information about who held a lease and when, which will be kept forever. - Your rights and your personal data
Unless subject to an exemption under data protection legislation, you have the following rights with respect to your personal data:
• The right to request a copy of your personal data which ISHA holds about you;
Please contact dataprotection@isha.co.uk if you want access to any of your personal data.
• The right to request that ISHA corrects any personal data if it is found to be inaccurate or out of date;
• The right to transfer personal data from our electronic processing system to another organisation’s electronic processing system;
• The right to lodge a complaint with the Information Commissioners Office;
• Where we rely on your consent as your legal basis to process your personal data, you have the right to withdraw your consent and ask for your data to be deleted or restrict/object to some elements of the processing. As we explain above, we will not rely on consent in many cases. - Erasure (Your Right to be Forgotten)
You have the right to ask us to delete personal information we hold about you. You can do this where:
• the information is no longer necessary in relation to the purpose for which we originally collected/processed it
• you withdraw consent
• you object to the processing and there is no overriding legitimate interest for us continuing the processing
• we unlawfully processed the information
• the personal information has to be erased in order to comply with a legal obligation
We can refuse to erase your personal information where the personal information is processed for the following reasons:
• where we have an overriding legitimate interest for continuing with the processing
• to exercise the right of freedom of expression and information
• to enable functions designed to protect the public to be achieved eg government or regulatory functions
• to comply with a legal obligation or for the performance of a public interest task or exercise of official authority
• for public health purposes in the public interest
• archiving purposes in the public interest, scientific research historical research or statistical purposes
• the exercise or defence of legal claims. - Further processing
If we wish to use your personal data for a new purpose, not covered by this Privacy Statement, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing
conditions. Where and whenever necessary, we will seek your prior consent to the new processing. - Who do you contact?
To exercise all relevant rights, queries of complaints please in the first instance contact ISHA at dataprotection@isha.co.uk or at 0300 131 7300. - How can you complain?
If you are not happy with the way your information is being handled, or with the response received from us you can contact the Information Commissioners Office on 0303 123 1113 or via their website: https://ico.org.uk/make-a-complaint/
.
Approved by: Data Protection Group, October 2024