Most of the information we have about you and your family comes from you. We record information whenever you contact us or use our services so that we have a record of what happened.

We may also get information from our partner organisations, your family, friends or neighbours, somebody who makes a complaint on your behalf or our colleagues.

We may get information about you from the police, Probation Services, Social Services, Disclosure and Barring Service or courts under certain circumstances.

We get information from other public information sources including credit reference agencies.

We get information about your benefits and Council Tax from the Department of Work and Pensions and your local Council.

One of the ways we use your information is to prevent and detect crime.  We share information with partners and other agencies to detect housing fraud and prevent benefit fraud.  In particular, whg will identify and act on cases of tenancy fraud where customers are applying for or living in a property that they are not entitled to.

If you are violent or abusive to whg colleagues, customers or other residents, we may decide to place a “violent warning marker” on your customer record in order to protect whg colleagues.  If we do this, we will write and tell you why and you will have the right to appeal against our decision.

We will share this information with our partners, for example our contractors or the Fire Service in order to protect their colleagues too.

We will usually keep information about you for as long as you are our customer and for another six years.  Legal documents may need to be kept for 12 years.

whg uses our industry standard Retention Schedule to determine how long we keep information.

We will store your information securely in computer systems or in certain circumstances in manual files.  We will dispose securely of all information when it is no longer necessary for the purposes of administering your tenancy.

We will share some or all of the information we hold about you with:

• The appropriate people at whg and the other companies in the Group, depending on what services you need (for example the Community Safety team or Money Advisors)
• Other companies that deliver services on behalf of whg, such as contractors that carry out repairs or handle our out of hours calls, IT service providers, banks, companies that assist us in mailing out newsletters and rent statements, professional advisors and auditors
• Your local council, Social Services and Department of Work and Pensions
• We send information about new lettings to the Ministry of Housing, Communities and Local Government – this does not identify individuals but provides information for research purposes on all social housing lettings
• Probation Services, NHS
• Solicitors or legal advisors
• Other landlords (if you want to move to another property or to get references)
• Energy and water suppliers, to set up your utilities or help you to sort out bills

We may share your information with the police for the prevention and detection of crime, including fraud and benefit fraud.

We only share the minimum amount of personal data necessary to enable us to fulfil our legal obligations.

We will not sell your personal data.

The law says that we have to meet a legal condition under the Data Protection Act 2018 before we can process (which includes sharing) your personal data.

The conditions which usually apply for the personal data that we process for customers are:

For the performance of a contract: for our landlord / tenant service

To comply with a legal obligation: for example, to check your Right to Rent in the UK

For our or your legitimate interests: this allows us to collect your name, contact details and other non sensitive information and share it with our partners for our own administrative purposes or in line with our policies.  This includes sharing your information with Rental Exchange.

The conditions that apply for processing sensitive information are:

To make sure that we are providing equal opportunities: this is why we ask you for your ethnicity, whether you have a disability etc.  You don’t have to tell us this information if you don’t want to, unless you want us to take it into account to provide a service to you or move you to a more suitable home.

To protect your vital interests: for example if you have an accident or are taken ill, or if we believe that you or a member of your household might be in danger.

We ask for your explicit consent: to process sensitive information about your ethnic origin, sexuality, religion and health problems or disability, but only if you choose to tell us.

You don’t have to tell us if you don’t want to, but it might help us to help you if you need our support for some reason.

whg is a member of Rental Exchange.  We share your tenancy details and rent payment history with a company called Experian to help you create an online proof of identify, proving to organisations that you are who you say you are.

This gives you the credit you deserve for paying your rent on time – in the same way as your mortgage payments would if you were a home owner – and improves your credit report.  It creates an online history of your rental payments to prove to companies that you are a reliable potential customer by proving who you are and where you live.

A good credit profile will make it easier for you to open or change bank accounts, shop online, get better mobile phone rates or better gas and electricity rates, or get a better credit card deal.

This arrangement also helps us as your landlord to build a clearer view of your financial well-being, to identify customers who may be in financial stress or are at risk of falling behind on payments in future.  This helps us to help you if you are in danger of getting into difficulties.

Not only will we be able to work with you more closely to manage your existing tenancy agreement, your track record as a customer will enable Experian to use the information supplied to them to assist other landlords and organisations to:

• assess and manage any new tenancy agreements you may enter into;
• assess your financial standing to provide you with suitable products and services;
• manage any accounts that you may already hold, for example reviewing suitable products or adjusting your product in light of your current circumstances;
• contact you in relation to any accounts you may have and recovering debts that you may owe;
• verifying your identity, age and address, to help other organisations make decisions about the services they offer;
• help to prevent crime, fraud and money laundering;
• screen marketing offers to make sure they are appropriate to your circumstances;
• for Experian to undertake statistical analysis, analytics and profiling; and
• for Experian to conduct system and product testing and database processing activities, such as data loading, data matching and data linkage.

If you would like to see more information on these, and to understand how the credit reference agencies each use and share rental data as bureau data (including the legitimate interests each pursues) this information is provided in this link: www.experian.co.uk/crain (Credit Reference Agency Information Notice (CRAIN)). (For a paper copy, please get in touch with Jaz Kaur on 0300 555 6666).

If you do not want your data to be shared with Rental Exchange, please email DataProtection@whgrp.co.uk with your name and address with the words Rental Exchange opt-out in the subject line.  If you have no access to email you can also call 0300 555 6666 and ask to speak to the Data Protection Officer about the Rental Exchange programme.

We may get your information from social media, whether on our own sites or elsewhere.  Where you make something public on whg’s website or social media you give us your consent, to copy, use and reproduce any of your contributions for any purpose.

Where something you put on social media (whether on our own site or elsewhere) is inappropriate and constitutes a breach of our policies or any laws, we may take the following actions:

• Issue you with a warning.
• Start legal proceedings against you for reimbursement of all costs resulting from the breach
• Report you and disclose information to the appropriate law enforcement authority or statutory body as we feel is necessary.
• Publish information about you as we reasonably feel is appropriate, publicly (which may include social media).

We may also withdraw your right to use our social media or remove/edit any posting or material uploaded by you to our social media.

Most of the information we hold about you and your household is used to fulfil a contractual obligation (between whg as your landlord and you as our customer) or a legal obligation (for example, providing your details to the Department of Work and Pensions).

If you don’t provide us with your information, we won’t be able to provide you with a landlord service.

The law gives you the following rights about what we do with your personal information – the right to:

• be informed about what we do with your personal information (which is why we have published this Customer Privacy Notice and a leaflet)
• get a copy of the information we hold about you (this is known as a Subject Access Request)
• ask us to correct information that is wrong
• stop us from doing certain things with your information, for example if you think the information is wrong
• object to us using it for marketing
• get us to delete your information in certain circumstances
• get an electronic copy of your information so that you can send it to another company
• object to any important decisions being taken about you automatically
• claim compensation (through the courts) if we misuse your information
• if you have previously given us your consent to use your information for something, you can change your mind

If you want a copy of the information we hold about you (rather than information about your rent, repairs or your home) or want to know more about any of these rights, ring 0300 555 6666 and ask to speak to the Data Protection Officer.

We do not use computers to make automatic decisions about our customers.

If you have any questions about the way in which we collect, process or store your information please speak to any colleague or the Data Protection Officer.

If you want a copy of the information we hold about you (this does not include information about your rent, repairs or your home):

Subject access request procedure

1      Introduction

This information tells you what to do when making a subject access request (i.e. asking us for a copy of the information that we hold about you) and what we do when we receive such a request.

Because we process personal information about individuals (‘data subjects’), we are obligated under the law to protect that information and to obtain, use, process, store and destroy it, only in line with data protection principles.

2      The General Data Protection Regulation (GDPR)

The GDPR gives individuals the right to know what information is held about them, to access this information and to exercise other rights, including the rectification (correction) of any inaccurate data.

whg abides by the GDPR principles, which are that personal information is:

1. processed lawfully, fairly and in a transparent manner in relation to the data subject
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures

GDPR also requires whg to be accountable for our actions and able to demonstrate how we comply with the GDPR principles.

whg has controls in place to protect your personal information and make sure that it is only obtained, processed and disclosed in accordance with the law.

3    What is Personal Data?

Information protected under the GDPR is known as “personal data” and is defined as:

“Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Further information on what constitutes personal information and your rights under the data protection regulation and laws can be found on the Information Commissioner’s Office (ICO) website.

4    The Right of Access

You have the right to know whether whg holds personal data about you.  You are also entitled to know:

• the purposes of the processing
• the categories of personal data concerned
• the recipient(s) or categories of recipient(s) to whom the personal data have been or will be disclosed
• whether the data has been transferred to a third country or international organisation(s) (and if applicable, the appropriate safeguards used)
• the envisaged period for which the personal data will be stored (or the criteria used to determine that period)
• where the personal data was not collected directly from the individual, any available information as to its source

5       How to make a Subject Access Request

A subject access request (SAR) is a request for access to the personal information that whg holds about you.

You can make this request in writing using the details provided in section 10, or you can send your request by emailing DataProtection@whgrp.co.uk

Where a request is received by electronic means, we will provide the requested information by email unless you ask us for a hard copy.

6       What happens when we receive a Subject Access Request?

Checking your identity

Your request will be passed to the Data Protection Officer (DPO) as soon as it is received and the request will be recorded.

The DPO will ask you to complete a form and ask you to provide evidence of your identity before dealing with your request.  This is to protect your information and rights.

If a third party, relative or representative is requesting the information on your behalf, we will verify their authority to act for you and again, may contact you to confirm their identity and get your authorisation before dealing with the request.

Information Gathering

If you have provided enough information in your request for us to find the personal information held about you, we will gather all the documents relating to you.  If we do not have enough information to locate your records, we may contact you for further details. This will be done as soon as possible and within the timeframes set out below.

Providing the Information to you

Once we have gathered all the personal information held about you, we will send this to you in writing or by email if requested.  The information will be in a concise, transparent, intelligible and easily accessible format, using clear and plain language.

7       Fees and Timeframes

SARs will be completed within one calendar month from the date when we receive your signed request, proof of identity and enough information for us to find your data.

There is no fee, but we may charge for further copies requested.

whg aims to provide the requested information as soon as possible, but at a maximum, one calendar month from the date the request is received.  However, where obtaining the information is particularly complex or is subject to a valid delay, the period may be extended by two further months.  If this is the case, we will write to you within 30 days and keep you informed of the delay and provide the reasons.

8       Exemptions

The GDPR contains certain exemptions from the provision of personal information.  The most common one is that you are only entitled to personal data about yourself, not about any other individuals.  If one or more of these exemptions applies to your subject access request or where whg is unable to act upon the request, we will inform you within one month of receipt of the request.

Where possible, we will provide you with the reasons for not acting and with information about how to make a complaint.

9       Sending in your request

To submit your request for personal data (Subject Access Request), you can contact us by email at DataProtection@whgrp.co.uk

You can also submit your request in writing to:

Sofia Ali, Data Protection officer
whg
100 Hatherton Street
Walsall
WS1 1AB

or phone 0300 555 6666

You can use this form.

10     Your Other Rights

You also have the right to request rectification (correction) of any inaccurate data held by us.  If you notify us that some data about you is wrong and we agree that the data is incorrect, we will amend the details as directed by you and make a note on our records of the change and reasons.

We will rectify any errors within one month and inform you in writing of the correction and where applicable, provide the details of any third party to whom the data has been disclosed.

If for any reason, we are unable to act in response to a request for rectification, we will provide a written explanation to you and inform you of your right to complain to the ICO.

In certain circumstances, you may also have the right to request the erasure (deletion) of personal data or the right to object to the processing of your personal data.  You can use the contact details in section 9 to make such requests.

You also have the right in law to object to ‘automated decision making’.  However, whg does not make automated decisions by computer alone; there is always human intervention.

If you are unsatisfied with our actions or want to make a complaint, you can contact us as stated above or by following the instructions for making a complaint on our website.

11 Supervisory Authority

If you are still not satisfied with our actions, you have the right to complain to the ICO at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
Email: enquiries@ico.org.uk

You can make a complaint about the way that we handle your personal information by following our usual complaints procedure.

If you feel that we have not dealt with your complaint properly, you can contact the Independent Information Commissioner’s Office.  Go to https://ico.org.uk/concerns/ for more details or phone 0303 123 1113.

This Privacy Notice will be updated from time to time to reflect changes either to the way in which we operate or changes to the data protection legislation.  To make sure that you keep up to date, we suggest that you revisit this notice from time to time.