Most of the information we have about you and your family comes from you. We record information whenever you contact us or use our services so that we have a record of what happened.
We may also get information from our partner organisations, your family, friends or neighbours, somebody who makes a complaint on your behalf or our colleagues.
We may get information about you from the police, Probation Services, Social Services, Disclosure and Barring Service or courts under certain circumstances.
We get information from other public information sources including credit reference agencies.
We get information about your benefits and Council Tax from the Department of Work and Pensions and your local Council.
The law says that we have to meet a legal condition under the Data Protection Act 2018 before we can process (which includes sharing) your personal data.
The conditions which usually apply for the personal data that we process for customers are:
For the performance of a contract: for our landlord / tenant service
To comply with a legal obligation: for example, to check your Right to Rent in the UK
For our or your legitimate interests: this allows us to collect your name, contact details and other non sensitive information and share it with our partners for our own administrative purposes or in line with our policies. This includes sharing your information with Rental Exchange.
The conditions that apply for processing sensitive information are:
To make sure that we are providing equal opportunities: this is why we ask you for your ethnicity, whether you have a disability etc. You don’t have to tell us this information if you don’t want to, unless you want us to take it into account to provide a service to you or move you to a more suitable home.
To protect your vital interests: for example if you have an accident or are taken ill, or if we believe that you or a member of your household might be in danger.
whg is a member of Rental Exchange. We share your tenancy details and rent payment history with a company called Experian to help you create an online proof of identify, proving to organisations that you are who you say you are.
This gives you the credit you deserve for paying your rent on time – in the same way as your mortgage payments would if you were a home owner – and improves your credit report. It creates an online history of your rental payments to prove to companies that you are a reliable potential customer by proving who you are and where you live.
A good credit profile will make it easier for you to open or change bank accounts, shop online, get better mobile phone rates or better gas and electricity rates, or get a better credit card deal.
This arrangement also helps us as your landlord to build a clearer view of your financial well-being, to identify customers who may be in financial stress or are at risk of falling behind on payments in future. This helps us to help you if you are in danger of getting into difficulties.
Not only will we be able to work with you more closely to manage your existing tenancy agreement, your track record as a customer will enable Experian to use the information supplied to them to assist other landlords and organisations to:
- assess and manage any new tenancy agreements you may enter into;
- assess your financial standing to provide you with suitable products and services;
- manage any accounts that you may already hold, for example reviewing suitable products or adjusting your product in light of your current circumstances;
- contact you in relation to any accounts you may have and recovering debts that you may owe;
- verifying your identity, age and address, to help other organisations make decisions about the services they offer;
- help to prevent crime, fraud and money laundering;
- screen marketing offers to make sure they are appropriate to your circumstances;
- for Experian to undertake statistical analysis, analytics and profiling; and
- for Experian to conduct system and product testing and database processing activities, such as data loading, data matching and data linkage.
If you would like to see more information on these, and to understand how the credit reference agencies each use and share rental data as bureau data (including the legitimate interests each pursues) this information is provided in this link: www.experian.co.uk/crain (Credit Reference Agency Information Notice (CRAIN)). (For a paper copy, please get in touch with Jaz Kaur on 0300 555 6666).
If you do not want your data to be shared with Rental Exchange, please email email@example.com with your name and address with the words Rental Exchange opt-out in the subject line. If you have no access to email you can also call 0300 555 6666 and ask to speak to the Data Protection Officer about the Rental Exchange programme.
If you want a copy of the information we hold about you (this does not include information about your rent, repairs or your home):
Subject access request procedure
This information tells you what to do when making a subject access request (i.e. asking us for a copy of the information that we hold about you) and what we do when we receive such a request.
Because we process personal information about individuals (‘data subjects’), we are obligated under the law to protect that information and to obtain, use, process, store and destroy it, only in line with data protection principles.
2 The General Data Protection Regulation (GDPR)
The GDPR gives individuals the right to know what information is held about them, to access this information and to exercise other rights, including the rectification (correction) of any inaccurate data.
whg abides by the GDPR principles, which are that personal information is:
- processed lawfully, fairly and in a transparent manner in relation to the data subject
- collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
- accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
- kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures
GDPR also requires whg to be accountable for our actions and able to demonstrate how we comply with the GDPR principles.
whg has controls in place to protect your personal information and make sure that it is only obtained, processed and disclosed in accordance with the law.
3 What is Personal Data?
Information protected under the GDPR is known as “personal data” and is defined as:
“Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
Further information on what constitutes personal information and your rights under the data protection regulation and laws can be found on the Information Commissioner’s Office (ICO) website.
4 The Right of Access
You have the right to know whether whg holds personal data about you. You are also entitled to know:
- the purposes of the processing
- the categories of personal data concerned
- the recipient(s) or categories of recipient(s) to whom the personal data have been or will be disclosed
- whether the data has been transferred to a third country or international organisation(s) (and if applicable, the appropriate safeguards used)
- the envisaged period for which the personal data will be stored (or the criteria used to determine that period)
- where the personal data was not collected directly from the individual, any available information as to its source
5 How to make a Subject Access Request
A subject access request (SAR) is a request for access to the personal information that whg holds about you.
You can make this request in writing using the details provided in section 10, or you can send your request by emailing firstname.lastname@example.org
Where a request is received by electronic means, we will provide the requested information by email unless you ask us for a hard copy.
6 What happens when we receive a Subject Access Request?
Checking your identity
Your request will be passed to the Data Protection Officer (DPO) as soon as it is received and the request will be recorded.
The DPO will ask you to complete a form and ask you to provide evidence of your identity before dealing with your request. This is to protect your information and rights.
If a third party, relative or representative is requesting the information on your behalf, we will verify their authority to act for you and again, may contact you to confirm their identity and get your authorisation before dealing with the request.
If you have provided enough information in your request for us to find the personal information held about you, we will gather all the documents relating to you. If we do not have enough information to locate your records, we may contact you for further details. This will be done as soon as possible and within the timeframes set out below.
Providing the Information to you
Once we have gathered all the personal information held about you, we will send this to you in writing or by email if requested. The information will be in a concise, transparent, intelligible and easily accessible format, using clear and plain language.
7 Fees and Timeframes
SARs will be completed within one calendar month from the date when we receive your signed request, proof of identity and enough information for us to find your data.
There is no fee, but we may charge for further copies requested.
whg aims to provide the requested information as soon as possible, but at a maximum, one calendar month from the date the request is received. However, where obtaining the information is particularly complex or is subject to a valid delay, the period may be extended by two further months. If this is the case, we will write to you within 30 days and keep you informed of the delay and provide the reasons.
The GDPR contains certain exemptions from the provision of personal information. The most common one is that you are only entitled to personal data about yourself, not about any other individuals. If one or more of these exemptions applies to your subject access request or where whg is unable to act upon the request, we will inform you within one month of receipt of the request.
Where possible, we will provide you with the reasons for not acting and with information about how to make a complaint.
9 Sending in your request
To submit your request for personal data (Subject Access Request), you can contact us by email at Data.Protection@whgrp.co.uk
You can also submit your request in writing to:
Data Protection officer
100 Hatherton Street
or phone 0300 555 6666
You can use this form.
10 Your Other Rights
You also have the right to request rectification (correction) of any inaccurate data held by us. If you notify us that some data about you is wrong and we agree that the data is incorrect, we will amend the details as directed by you and make a note on our records of the change and reasons.
We will rectify any errors within one month and inform you in writing of the correction and where applicable, provide the details of any third party to whom the data has been disclosed.
If for any reason, we are unable to act in response to a request for rectification, we will provide a written explanation to you and inform you of your right to complain to the ICO.
In certain circumstances, you may also have the right to request the erasure (deletion) of personal data or the right to object to the processing of your personal data. You can use the contact details in section 9 to make such requests.
You also have the right in law to object to ‘automated decision making’. However, whg does not make automated decisions by computer alone; there is always human intervention.
If you are unsatisfied with our actions or want to make a complaint, you can contact us as stated above or by following the instructions for making a complaint on our website.
11 Supervisory Authority
If you are still not satisfied with our actions, you have the right to complain to the ICO at:
Information Commissioner’s Office
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)