Privacy Policy
Privacy Policy
This privacy statement describes how Coastal Housing demonstrates its commitment to privacy. The following discloses the information gathering and distribution practices for this website.
What is the purpose of this document?
We are committed to protecting the privacy and security of the personal information of people we work with and who we provide services for. This privacy notice describes what and how we collect and use personal information about these people, in accordance with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.
Coastal Housing Group Limited, (“Coastal”), is a “data controller”. This means that we are responsible for deciding how we hold and use people’s personal information. We are required under data protection legislation to issue this privacy notice to explain things such as: what information we hold, how we use it, how long we hold it for and importantly, what rights data subjects have in respect of our use of their information.
This privacy notice does not form part of any contract or occupation agreement and we may update this notice at any time. This policy was last updated in October 2020.
A separate notice exists for employees of Coastal Housing Group Limited.
It is important that you read this privacy notice and associated documents, together with information in Coastal’s data protection policy so that you are aware of how and why we are using people’s personal information.
About Us
Coastal Housing Group Limited
3rd Floor Urban Village
220 High Street
Swansea
SA1 1NW
Tel: 01792 479200 Email: ask@coastalha.co.uk
Our Data Protection Officer is Paul Wood. He can be contacted via paulw@coastalha.co.uk
What personal information do we collect and process and where do we get it from?
Most of the personal data we process is information that has been provided to us by the people themselves, or has been provided in connection with existing tenancies, or new housing or job applications. This could include information like people’s name, address, telephone numbers, date of birth and bank account details etc.
Where Coastal offers additional services, such as housing-related tenancy support or a City Wheels scheme, the information we need to hold and why, will be explained at the commencement of the process. Sometimes we will obtain information from 3rd parties about people in the course of providing these and other services, and when we do we will be more than happy to explain this and where possible we will make this information available for the relevant people to see.
How does Coastal collect your information?
We collect personal information in a variety of , for example:
- Applications made to us for housing and associated services
- Information supplied to us from existing residents and their households
- Identity documents provided to us by applicants and existing residents
- Information provided in interviews and meetings
- Information provided by third parties such as care providers, the local authority or the Police
- Information provided to us from doctors and from medical and occupational health professionals
- Information from benefits agencies such as DWP and the local authority.
- Information from other professionals we may engage e.g. Occupational Therapists
- Information from door entry systems, CCTV, and access control systems
- Information from vehicle tracking systems where appropriate
Much of the information we collect and process is detailed in the Information Asset Register which is available as part of the data protection policy. Any specific questions in this respect should be directed to the Data Protection Officer.
If anyone ever has questions about what information we hold on them that has been received from 3rd parties, we will be happy to discuss this further.
All personal data will be stored securely.
Why do we process your personal data and the lawful basis?
We process your personal information, including any special categories of personal information for reasons, including but not limited to:
- Managing housing accounts with Coastal in line with the terms of the relevant occupation agreement
- Providing additional services as requested by residents or 3rd parties.
- Processing applications for housing.
- Improving the service or experience residents and some 3rd parties get from Coastal.
- Dealing with complaints
We process this information either because it’s necessary for us to do so or because there are laws that allow us, or require us, to process it. Our legal basis for storing and processing your data will vary depending on the situation but will normally be one of the following:
Contractual
This is where we would be unable to meet the terms of our contract with you without processing your data. Examples of this would be where you are applying to be, or are already renting a home from us and we need your details in order to collect rent payments.
Legitimate Interest
Coastal is continually working to improve the services it offers to residents. Often in order to do this we process and analyse a lot of data relating to our current services. This could be things like how long it took to let a property, to carry out a repair or how our services are rated. We may also use this basis to make you aware of services, events or initiatives that we think may be relevant to you unless this represents direct marketing.
We also use the Legitimate Interest basis for processing access to CCTV recordings.
Consent
In some instances we may require your consent in order to process your personal information. When this applies we will make this clear to you and will not process your information unless you consent. You can withdraw your consent at any time. Examples of when we might use your consent could be when taking photographs or video for use across Coastal’s communications.
Who has access to this data?
Resident / 3rd party data may be shared internally by the Housing teams, Finance, and managers in the relevant business areas only when there is a genuine business need to do so.
We will also sometimes share your data with specific third parties where appropriate such as DWP, the local authority or the Police. Your data is shared with these companies in line with the GDPR and where relevant the Data Protection Act 2018.
We also share some of your personal data with third parties who help us provide our services to you. These 3rd parties are called ‘data processors’ and we only do this when we are sure we are working with reputable companies who are obliged to keep your data safe and secure. Examples of this could include repairs operatives or credit reference agencies, and IT vendors who help us to store our data in secure data centre locations.
There may be situations where it’s necessary for us to share some of your information with external, (non data processor) organisations. Where this is the case, we will only make such disclosures when they are in line with our powers or obligations under the GDPR or where they’re required by law. Some of the organisations that we may share personal information with include, but are not restricted to:
- Legal advisers
- Emergency services
- Government departments including local authorities
- Credit reference agencies such as Experian
- Welfare advisers
- Medical professionals
- Other housing associations
- Utilities providers
- Market research companies for the purposes of conducting customer satisfaction surveys on our behalf
We ensure the organisations above and any others we might share information with understand that personal information provided must be used only for the reasons specified and must be kept safe and secure. Our relationships with some of these organisations are also bound by contractual data sharing agreements.
In some cases we may be legally required to provide information to one of these other organisations – for instance, in certain circumstances we may be required to provide information about housing benefits to a local authority or central government departments.
We will never sell your personal information to third parties and we’ll do our best never to send out marketing information if people do not wish to receive it.
Data transfer to from the UK to the EEA and other countries, post Brexit.
The UK left the EU on 31 January 2020. The transition period ended on 31 December 2020. This has changed the rules on how data can leave and enter the UK lawfully and appropriately.
Coastal is monitoring the guidance issued by the Information Commissioner’s Office on this matter from time to time.
Should anyone have any questions or concerns regarding their data leaving the UK via Coastal, then please contact the DPO at your convenience, to discuss further.
How does Coastal protect your personal data?
We take the security of your data seriously. We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is only accessed by staff when carrying out their role. Staff training is provided. We limit access to your personal information to those who have a genuine business need to know, and those who process your information are subject to a duty of confidentiality. Where we use third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of your data.
Should there be a personal data breach that is likely to result in a high risk of adversely affecting a person’s rights and freedoms, we will inform them, without undue delay. If required, we will also report any personal data breach to the Information Commissioner’s Office, in accordance with their guidance on these matters.
How long do we hold your personal information for?
In connection with managing a housing application, if you are unsuccessful, we hold your personal information for a period of up to 1 year after submission.
If you are successful in your application and take up a tenancy we retain your information during that time and for a period 6 years after you cease to be a tenant of Coastal. After 6 years, we’ll dispose of your personal information securely. Should we have to hold any of your personal information for longer than this, for example, on some of our computer systems, we’ll make every effort to anonymise it.
Your rights – You have several rights under data Protection Legislations, these include:
Right to withdraw consent
If you have consented to your data being processed and this is our lawful basis for processing, you can withdraw this consent at any time.
The right to be informed
We will tell you in clear and plain language when we are collecting, using, or sharing information about you.
The right of access
You have the right to know and see what information we hold on you. A written request is called a “Subject Access Request”. Usually, we must provide information within one month of your request.
The right to rectification
You have the right to have incorrect or incomplete information corrected within one month. This includes any information we have shared with other companies processing data on our behalf.
The right to erasure
You can request to be forgotten, but this would not be upheld where we have a right to hold information.
The right to restrict processing
You can ask us to stop using your personal information if you are contesting the accuracy or use of the information. We have to stop processing this information until we have corrected it or established, we have a legal right to use it.
The right to data portability
You can request certain information is shared with another organisation. This only applies to information that is carried out by automation and does not apply to the information we process.
The right to object
You can object to us using your information, for example, residents objecting to direct marketing.
Rights in relation to automated decision making and profiling
This applies to decisions made entirely by computers rather than staff and so does not really apply to Coastal at present.
If you would like to exercise any of these rights, please email: paulw@coastalha.co.uk
Automated decision-making
We do not make any decisions about you, using automated means and we do not envisage this changing in the near future. If the situation does change, we will notify you in writing.
Data Protection Officer
Coastal has appointed Paul Wood as its Data Protection Officer to oversee compliance with this privacy notice.
If you have any questions about this privacy notice or how we handle your personal information, please email paulw@coastalha.co.uk
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), who is the UK supervisory authority Information Commissioner’s Office
Information Commissioner’s Office – Wales
2nd floor, Churchill House
Churchill Way
Cardiff CF10 2HH.
(t) 0330 414 6421 (e) wales@ico.org.uk
Changes to this privacy notice
We reserve the right to update this privacy notice at any time. We may also notify you in other ways from time to time about the processing of your personal information.
Cookies
What is a cookie?
Cookies are little files that almost all websites use as a kind of memory. They are stored in your browser and enable a site to ‘remember’ little bits of information between pages or visits.
Why does Coastal use cookies?
We use cookies on pour website to distinguish you from other users of our website. This helps us provide a good experience when you use our site. We don’t use cookies to collect information other than that which will help you use our website and they can’t be used to identify you personally.
Do I have to consent to cookies?
No, you can block cookies in the popup you see when you visit our site or by changing settings in your web browser. However, if you do block cookies there may be areas of our website that you cannot access or that do not work properly for you.
This information can be provided to you via other means if you would prefer.
Implications of the United Kingdom’s departure from the European Union, (Brexit)
The European Union General Data Protection Regulation, (“GDPR”) is a European Union regulation and it no longer applies to the UK.
The GDPR has now been incorporated into UK data protection law as the UK GDPR so in practice there is little change to the core data protection principles, rights and obligations found in the UK GDPR.
The Data Protection Act 2018 continues to apply.
Coastal will continue to closely monitor guidance from the ICO to ensure any data transferred outside of the UK is done so appropriately.