Statement Last Updated on: 6 July 2021
High Level Summary of Changes: Update about UK and EEA data flows.
Purpose of Statement
As part of our commitment to ensuring we provide you with a first class service, we'd like to ensure you're aware of why we collect your data, how we use it and our legal basis for using it. Please take the time to familiarise yourself with our data protection related ways of working.
This notice outlines how we collect and use your information. We will treat any personal information which you provide to us in accordance with Data Protection legislation, including but not limited to the Data Protection Act 2018 (the “DPA”) and UK General Data Protection Regulation. Where data is processed within the EU we will also comply with the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”).
Who we are
We, meaning Network Homes Ltd and all associated group companies (“Network Homes”), as the Data Controller, who can be contacted at The Hive, 22 Wembley Park Boulevard, Wembley, HA9 0HP, are committed to respecting your privacy and complying with applicable data protection and privacy laws.
We are registered with the ICO under the following Registration numbers. Network Homes Limited (Parent Company) ICO registration number is ZA191631.
|Aylesbury House Management Company Ltd||ZA304163|
|Churchill Gardens Amenity Limited||ZA304152|
|Cosgrove House Management Company Ltd||ZA192916|
|Marsworth House Management Company Limited||ZA192940|
|Network Homes Investments (Stockwell) Limited (Formerly Community Housing Development Ltd)||ZA298785|
|Network Homes Investments Limited (Formerlly Network Stadium Investments Limited)||ZA298758|
|Network Homes Limited||ZA191631|
|Network Living Limited (formerly NHG Property Limited||ZA304169|
|Network Living Management Services Limited (dormant)||ZA298774|
|Network New Build Limited (Formerly WNB Limited)||ZA298750|
|Network Treasury Services Limited||ZA298767|
|Pimlico Village Developments Limited||ZA298777|
|Tay Road Amenity Limited||ZA304154|
|Venice House Management Company Limited||ZA304166|
Public Health Notice - COVID-9 Disclaimer
For the immediate future we will be collecting personal data concerning your status and details of health regarding Covid 19 Pandemic. We collect this as there is a substantial public interest to ensure the safety of everyone and help contain/delay the spread of the virus. We will store this personal data on our CRM system and it will keep a record of it for a period of six months post the pandemic (end of pandemic is to be confirmed by the UK Government). We will only share this personal data with public bodies or our contractors (who need to enter resident properties) if it necessary to do so.
Request for Personal data - if you are intending to exercise your right to access (requesting your personal data), Please may we encourage you to use the optional online form. Please be mindful that unless stated differently we will provide your personal data request electronically.
Notification of Processing Personal Data
What personal data do we collect and process?
Using our websites and portals
When requesting information about our services you may use a contact form where you are asked to enter your name, email address, postcode, phone number or other details to help your customer experience. Our forms also allow you to report incidents regarding anti-social behaviour.
If you are a resident, we collect information when you log in to our portal to pay your rent or request a repair. We collect your username, password and email address when you register on our resident portal for an account.
For individuals who use our vacancies page, we will collect information about your career history and your contact details to ensure we can assess your suitability for any vacancies you express an interest in.
We may collect information about how you use our website to keep improving the way it works. We may collect statistics on how many people are visiting our website pages, where they come from, when they visit and how long they stay and what pages they look at. This will include information about the originating IP addresses (which may infer your geographic location), internet service providers, the files viewed on our site and time stamps.
We may associate your device with your account if you log into our resident portal. We may use this type of information to give us insights into services our customers may like and how our website marketing is performing. We may also look at the browser, operating systems and devices you use to make sure you get a good online experience however you access our sites. See our Cookies page to find out more.
During your tenancy or lease
If you are one of our residents, we will require information about you in order to support you during your time in the property and manage your tenancy or lease with us. Additionally, we will require information about you to fulfil contractual obligations agreed in the contract with us. We will process the following personal data
- Names, Alias and titles.
- Contact details including email, postal address and mobile/ telephone phone number
- Property details including address, repair appointments and actions
- Household composition including number of household members and age.
- Opinions, feedback and/or complaints
- Financial data including bank account, income data and rent payment history (including over payments and arrears).
- CCTV imagery and photos
- Audio recordings
- Adaptions, support and welfare advice
- Queries, submissions and responses from all channels of communications
- Account Reference numbers and benefit information
- Date of birth or birthday/age indicators.
- Special Category personal data - health; race and ethnicity; religious and philosophical beliefs; sex life and sexual orientation and criminal activity.
As an occupier or prospective customer
If you are an occupier of one of our properties but not a tenant, a customer or simply interested in the services we provide, we may request information from you when you contact us in order to respond to your queries and to ensure we are able to provide you with the right services and equally provide you with value for time. We may also process information when sending you relevant updates to services or products that are aligned with your interest. You will be given the opportunity to opt-out of receiving any further information in alignment with your rights.
We may equally request and retain data from you if we are undertaking a tenancy audit and you are occupying one of properties. We do this for the legitimate business reason of ensuring we can detect, investigate and prevent tenancy fraud. Depending on the progress of the audit and if further investigations result, this data may be shared with relevant professionals and authorities on the lawful basis of legal proceedings having to be undertaken. We may request your consent to collect and process some of the data we require from you if you are not one of our confirmed tenants, however there may be instances where this is not required. We will ensure you are kept fairly notified of our reasons for requesting and processing your data at all times.
As a prospective employee or worker
If you are a prospective employee and are interested in any of our vacancies, we may request information on your career history and CV in order to ensure your suitability for the vacancy in which you have expressed an interest. We will also process information about you further if we select you for interview to go through our recruitment process. We will ask for equality personal data to ensure there is no bias in the recruitment process and we can generalise the profile of the diversity of all roles.
The personal data listed in each section is not exhaustive and we will always ensure you are made aware of what personal data we are capturing and how we will process it on collection except where there is invisible processing. Invisible processing includes testing of systems; tenancy fraud background checks and case management; and safeguarding referrals/case management.
What reasons do we process your personal data for?
How do we use your information
Any personal information we require from you will be used as described in this policy and in alignment with Data Protection principles and practices. We use the information you supply to:
- Respond to your enquiry (e.g. When you submit information for reporting anti-social behaviours)
- Contact you regarding property you have registered an interest in
- Coordinate repairs that you have requested (if you are a resident)
- Coordinate the payment of your rent (if you are a resident)
- Manage any remedial works required to your home and, if necessary, provide temporary accommodation to you
- Inform you of opportunities and service updates (if you are a resident)
- Obtain feedback and carry out market research
- Comply with relevant legislation and regulation.
What Lawful Basis do we rely on?
Based on the variety of services we provide, we rely on different lawful basis when processing your data.
- We will process your data to fulfill our contractual responsibility to you as a resident, staff member or supplier. An example of this would be processing your bank details to ensure payment of services.
- We will process your data to allow us to achieve our legitimate interests as an organisation that deliver and manage the provision of housing services.
- We will process your personal data when it is required by law or government policy. An example of this is using your contact details to arrange gas checks in line with our health and safety obligations.
- We will sometimes undertake research and analysis to further improve and enhance our services for you and also to meet our strategic objectives, which will require us to process your data. Research may involve collecting data, such as surveys, interviews or focus groups. We may also analyse internal data, such as income collection, repairs, complaints and lettings, although this list is not exhaustive. When processing personal data for research, we ensure to adopt appropriate safeguards such as pseudonymisation (where the data is not fully identifiable) and anonymisation (where there is no possibility of identification of an individual) of the data – which makes the data harder (Pseudonymisation) or impossible (anonymisation) to trace back to any one individual.
- We will process your personal data where we are required to do so as part of our public duty as providers of social housing
- There may be particular instances where we require your consent for processing your data. We will ensure consent obtained is aligned with current applicable legislation and is specific and informed. For more information on consent, please see our consent page.
We utilise cookies to enhance your browsing experience. Details can be found on our cookies page.
We are committed to ensuring we take all reasonable steps to protect your personal information. We secure access to our website pages using ‘https’ technology which ensures information being communicated from our website to you is protected from interference by attackers. We have also implemented the Payment Card Industry Standard PCI which ensures we are employing best practice when undertaking activities that involve being in contact with payment card data. We are also Cyber Essentials certified which is a certification that demonstrates a good level of cyber security protection and posture.
Who do we share your personal data with?
There will be times when we need to share your personal data with trusted third parties for various reasons. this is part of our legitimate interest to fulfil our duties, where we are required to by law and where we are obligated to support the duties of a public authority including the police service.
We sometimes share your personal data with trusted third parties for the purposes of carrying out our legitimate interests as a business. For example, contractors for doing repairs on your home, employment services professionals to support your interests in getting into work, agencies who may help you in your particular community or local authorities who we engage with as part of our service delivery to you. We may also share your personal data with electricity, water or gas companies where we are satisfied that there is an appropriate lawful basis to do so, such as a tenant being responsible for paying a bill.
When sharing your data, we aim to ensure:
- We only provide the minimal amount of information to the third party required to perform their duties
- They only use your data for the exact purposes we specify in our contract with them
- We work closely with them to ensure that your privacy is respected and protected
- If we stop using their services, any of your data held by them will either be deleted or rendered anonymous
Other times we may share your data
Sharing your data with Local Government: CORE
As a social housing provider, we are required by the Ministry of Housing, Communities and Local Government (MHCLG) to submit data on social lettings as part of the national monitoring requirements for allocation of social housing. CORE stands for the continuous recording of lettings and sales in social housing in England. It is a national information source that records information on the characteristics of both private registered providers and local authority new social housing tenants and the homes they rent. Click here for more information on CORE.
Sharing your data with third parties for customer surveys/feedback
We will share your name and contact details with appropriate third parties who will carry out email or telephone customer satisfaction survey’s on our behalf to enable us to improve our services - this also includes surveys for development, including buying a new home.
If you do not want to be included in these surveys, please complete our Opt-Out form located on the 'useful form' page.
We'd love for you to take part in the surveys and have your say. We love to hear when we're doing great, but we also want to know your feedback about any areas which you think need improving.
We aim to not contact anyone who is signed up to the telephone preference service and you will be given an opportunity at the time of any call to not participate.
Sharing data with public bodies to support investigations
We will only share personal data when we have verified the requester is acting in their duties and where there have a legal right to the personal data. For more information about sharing data with public bodies see our page request for personal data by public body.
How long will you keep my personal data?
Information is only kept as long as necessary for the period it is required.
When deciding how long we keep your information we take into account any minimum retention requirements set out in law; for example, financial and statutory reporting requirements mean we must keep certain records for a period of 7 years.
Depending on the purpose for which we hold your personal data, retention periods may vary.
Transferring data outside the UK
We have taken steps to ensure all personal data is provided with adequate protection and that all transfers of personal data outside the UK are done lawfully.
We will only share/process personal data outside the United Kingdom where there is adequacy status which infers that the country of transfer has appropriate data protection legislation through adequacy status or where we have a approved safeguard for restricted transfers such as standard contract clauses.
Data transferred between the UK and EEA will continue to flow with no additional safeguards under the Adequacy agreement approved by EU Commission (June 2021)
As part of our contract with you we will send routine service messages via electronic communications such as text, email, voicemail etc where we have appointments booked and /or important information to share regarding changes of our services and/or health and safety updates. This is a requirement of ours under your contract with us and therefore you are not able to object to receiving such communications.
As part of our business legitimate interest we will contact you by text, email, voicemail or social media for:
- Market research - we will contact you were we are carrying out any research of the sector and seek your consultation or experiences.
- Customer Satisfaction Feedback - we will contact you to ask how your recent experience has been with us as landlords so that we can review the feedback and see what improvements is needed to the services you are provided.
- Training Opportunities and Jobs ring fenced for residents - we will let you know of any opportunities in your area to develop your skills and build up your CV.
- Signposting for support services- we may give you contact details or websites of agencies that support debt, benefits, food banks, addictions, health etc.
- Resident E-Newsletter- we will send your resident e newsletter via email so you are kept up to date with what we are doing for you and how we can support you.
- Contact regarding resident boards/panels - we will contact you to notify you if any openings come up on the resident panels and giving you the opportunity to have your say how we work.
- Invites to events that give you a voice, opportunity to get involve and improve yourself.
The above list does not constitute as 'direct marketing' and it is not an exhaustive list.
You are free to exercise your right for objection/restriction of using your contact details for these messages. You can exercise your right by emailing email@example.com or completing our online form. Please note we will not consider any objections to routine service update messages as we have no suitable alternative way to communicate these essential updates to you.
We will only send direct marketing messages by electronic communications where we have your consent to do so or if we have an existing commercial relationship with you and where that marketing material relates to similar services. (I.e. where there is an interest/sale of our commercial properties).
We will send letters when it is appropriate to do so to either the property address or a different corresponding address depending on your preference.
Please be mindful that when sending and receiving post we are relying on the national postal system and therefore are not able to guarantee delivery or receipt of every post sent/received.
Responding to requests
Please be mindful that should you contact Network Homes for any reasons you will get a response to acknowledge and resolve your query. We do not require your consent for responding to queries or contacting you via phone/ email to gain further information.
Most calls to our Customer Service Centre line will be recorded. This is for the purposes of training, monitoring and support with investigations/legal claims. Calls to and from the outside line of the Customer Service Centre are not recorded. We only hold recordings for six months and these is a set automation within the recording system. Where recordings have been downloaded to support an ongoing investigation/ legal claims these will be kept for the duration of the case or a minimum of three years for complaints audit purposes, which ever is later. Should you wish to obtain a copy of these recordings, you can do so under a Subject Access Request. Please see our 'your personal rights' for more information.
Please note that most senior managers email inbox is accessed and monitored by a personal assistant so as to ensure timely review and action of urgent issues arising in accordance with the privacy arrangements in place at Network Homes. We also have shared inbox's and access to individual inboxes in the need for business continuity. When sending any emails to Network Homes, please be aware you are contacting Network Homes and not the individual themselves.
If you have any concerns, please contact our DPO.
If you get any suspicious mail that claims to be from Network Homes, please may we encourage you to contact Network home immediately so we can investigate and remind you not click any links. You can raise your concerns to network by contacting the DPO at DPO@networkhomes.org.uk
From time to time Network will contact you and provide links, to check if a link is genuine you can hoover over the link (without clicking) and see whether the URL address is that of Network Homes or trusted partners. More information on Phishing.
What are your rights over your personal data?
Under data protection law, you have the right to:
- request access to the personal data we hold about you , without charge (certain exceptions apply.)
- request correction of your personal data if it is incorrect or out of date. If the data we hold about you is out of date, incomplete or incorrect you can inform us and your data will be updated.
- request that we delete your data. If you feel we should no longer be using your data you can request that we erase the data that we hold. Upon receiving a request for erasure we will confirm whether it has been deleted or the reason why it cannot be deleted (for example because we have a legal obligation to keep the information or we need it for a compelling legitimate business interest).
- object to processing of your data. You may request that we stop processing information about you. Upon receiving your request we will contact you and let you know if we are able to comply or if we have legitimate grounds to continue to process your data. Even after you exercise your right to object, we may continue to hold your data to comply with your other rights or bring or defend legal claims.
- request that we transfer your data to another controller if the data is processed by automated means (ie excluding paper files) and we will provide this in a machine readable format including PDFs, CSV/excel and Word documents.
- request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- request to withdraw consent for processing your data if that process relies on consent. For more information see our consent page.
We will comply with your request where it is feasible to do so, within one calendar month of receiving your request. There are no fees or charges for the first request. However additional requests for the same data may be subject to an administrative fee of £25 per request.
The law permits you the right to make a complaint about the way your personal data is handled. In the first instances, please use our optional form located on our Useful Forms Page, or alternatively email DPO@networkhomes.org.uk If you are not happy with their response then you are then entitled to make a complaint to the UK supervisory authority for data protection, the Information Commission Officer (ICO).
Right to complain
Reporting a Data Protection Incident
Should you find out that there has been a loss of personal data that we use or manage, or an unlawful use or disclosure of this data, please report this to us by contacting our Data Protection Officer by the Incident Reporting Form on the useful forms page.
If you feel that your data has not been handled correctly and following liaison with our Data Protection Officer, you are still not satisfied with responses received to any requests you have made regarding the use of your data, you have the right to lodge a complaint with the Information Commissioner’s office (ICO). You can contact them by calling 0303 123 1113 or go online to www.ico.org.uk. If you are based outside the UK, you have the right to lodge your complaint with the relevant data protection regulator in your country of residence.
We demonstrate accountability with data protection legislation by:
- Appointing a designated Data Protection Officer (DPO) to provide us advice and monitor our compliance with the legislation
- Maintaining records about our processing of personal data including lawful basis and retention. This is known as Records of Processing.
- Carry out Data Protection Impact Assessments (DPIA) where the processing of personal data may give rise to high risks to your rights and freedoms. Example of this is the implementation of a new IT system or new process which captures very sensitive personal data.
- Having appropriate contracts or agreements governing the sharing of personal data where required.
- Registered with the IC.
- Providing staff training and access to a full suite of polices, procedures, forms and material for lawful processing of personal data and compliance with data protection laws.
- Being transparent about our processing of your personal data as per this Privacy Statement and Fair Processing Notice on all forms that collect personal data where required.
Need more information?
You can also write to our Data Protection Officer at The Hive, 22 Wembley Park Boulevard, Wembley, HA9 0HP.