Manningham Housing Association (MHA) Limited operates from Bank House, Manor Row, Bradford, BD1 4QE and is a provider of social housing to the communities of Bradford and Keighley.
MHA is data controller as defined in the 2018 General Data Protection Regulations (GDPR). The Data Protection Officer for MHA can be contacted on email@example.com.
We are registered with the Information Commissioners Office under reference: Z728485X and we are open and transparent about the information we hold, why we hold it and for how long.
MHA generates records from our contact with you, including records of some personal information which is subject to the GDPR 2018. We hold and process this information in order to fulfil our contract to you and facilitate our legitimate interests as a social landlord.
Who does the personal information relate to?
- Customers (tenants)
This includes current, former and potential customers, who live in our properties and could also include their family and people associated with them.
- Colleagues (employees)
This includes current, former and potential colleagues, as well as Board and Committee members, apprentices and work experience students.
GDPR promotes the following principles:
- Processed lawfully, fairly and in a transparent manner.
- Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes.
- Adequate, relevant and limited to what is necessary in relation to those purposes.
- Accurate and, where necessary, kept up to date.
- Kept in a form which permits your identification for no longer than is necessary for those purposes.
- Processed in a way that ensures appropriate security of the data.
The GDPR provides the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision-making and profiling.
If you feel that any of your rights have been infringed, you have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk). Please review the details below to find out more.
How do you use my records?
We will collect, process, share and securely store personal information in compliance and the GDPR 2018. We will use this information to fulfil our contract to you as a social landlord.
We keep these records to allow us to:
- Make allocations
- Manage tenancies
- Receive rent and service charges
- Provide a repairs and maintenance service
- Provide home ownership products
- Offer help with debts and benefits
- Prevent & detect crime and resolve disputes
- Promote safety and the quiet enjoyment of our neighbourhoods & communities
- Engage with customers and make improvements to our services
- Promote equal opportunities and fair treatment for all colleagues and customers
- Provide employment and training advice and opportunities
- Manage employment and staff development
- Work with partners to deliver mutual success
- Provide information (e.g. about services) you request from us.
How long will you keep information for?
All information will be retained in accordance with the requirements of our retention schedule which is based on the National Housing Federations (NHF) Retention Schedule guidelines. As a general rule, we hold personal information for as long as you have a contract with us, plus up to 6 years or 6 years after any arrears have been settled.
“Sensitive” personal information
Under GDPR certain personal information is classified as “sensitive”. Sensitive data is information relating to physical or mental health, sexual orientation, religious or philosophical beliefs, political opinions, membership of a Trade Union, allegations of criminal offences and criminal convictions and offences. We minimise our holding and use of sensitive categories of personal information but, given the services we provide, there are times when we use it, for example when providing accommodation for disabled persons, when resolving neighbourhood disputes involving alleged criminal activity or when helping someone to access care services.
When we collect specific sensitive data we will notify you of how we will use it, including who it may be shared with.
How do we collect personal information for tenants?
We collect information in a variety of ways including on various forms, tenancy agreements, and contracts; through our on-going contact with you; in some cases we collect CCTV images. Calls to and from our main office phones may be recorded.
When you apply to become a MHA customer, we request and hold on file any references necessary to assess your application including as appropriate (but not limited to):
- References from other housing providers/private landlords
- Your mortgage lender (if you own/have owned your own home)
- Agencies such as the Police, the Probation Service, support workers, social workers, mental health workers and
- Credit reference agencies.
If you provide us with personal information relating to members of your family or your associates we you will need where appropriate their consent to the collection and processing of the information.
It is important that you notify us of any changes to your personal information.
How do we collect personal information for job applicants?
Personal information about unsuccessful candidates will be held for 6 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.
Once a person has taken up employment with MHA, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment and is outlined below.
How do we collect personal information for employees?
For employees we collect and hold on file:
- Job application form
- IT setup form for IT provider
- Right to Work documentation
- Starter form
- Letter of appointment
- Contract of employment
- Details to create an e-learning account
- Information for payroll to pay salaries
- Mobile phone information
- Driver details for insurance purposes
- Details for swipe card system
- Details for healthcare provider
- Details for Pension provider.
Once employment with MHA has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it. Further details for exactly what we hold, why we hold it and who it is shared with can be obtained from our HR department.
How secure is the information?
We take information security very seriously and we use digital security technology to ensure that data is safe and secure. We ensure that third parties working with us adhere to the same high standards of security. Where information is held in paper files, we ensure safe physical protection of the records in locked filing cabinets and rooms. We also operate a clear desk policy to ensure that paperwork is not left on desks or information on computer screens whilst the member of staff is away.
Complaints or enquiries
We take any complaints we receive about personal data processing very seriously. We welcome any suggestions for improving our procedures. If you do make a complaint or enquiry we may collect and store personal information in relation to this matter, which may include accessing CCTV or phone recordings. We will keep it secure and use it only for the purpose it was collected. When the matter is resolved or completed, we will retain the details in accordance with our retention schedule and then destroy them.
Information we collect via the website
We collect and store personal information via our website for a number of reasons including to help us provide better services and products to customers and potential customers. The information we collect fits into two categories:
- Personal information entered into online forms by visitors to this website.
- Anonymous statistical information collected by cookies.
If you request a repair, call back or information from us via an email, online form or register your interest in a service we will use your information to fulfil that request and delete once the request has been completed.
In order to provide you with the best experience, our website needs to place small text files, known as ‘cookies’, on your device.
Most cookies we use are ‘session’ cookies and only exist for the time that you are using our site. They perform functional tasks – such as remembering that you are logged in as you move from page to page.
We also track cookies anonymously for site analytics, to improve the user experience on our website and to make our products and services more relevant.
We also use technology that uses Internet Protocol (IP) information exchanges during the course of normal web activity combined with data-enhancement technology to get detailed analytics information. This only allows us to see how well our site is working and does not result in the collection of any personal data. Please see our Terms and Conditions on the website to find out more about Cookie use.
Some of our schemes and offices have CCTV in public areas to deter crime and anti-social behaviour and to promote public safety by helping to identify and prosecute criminal offenders. You can ask for a copy of any CCTV images taken of yourself by making a ‘subject access request’. See Accessing your Information.
Sharing your information
Your personal information will be kept secure and confidential. Usually we will not disclose personal data without consent but we may share information between the MHA group of companies such as:
- Contractors who deliver repairs and improvements (including our out-of-office providers)
- IT providers who manage our IT system and phones
- Training and Learning providers
- Distribution companies who help us to send our newsletter and other communications to you
- Third parties who help us to assess and manage our customer satisfaction
- Other agencies we work with, including Local Authorities, Social Services, Police, other social landlords and other agencies when MHA believes it is in your or the public’s interest to do so, or as required by law.
In particular, please be aware:
– Current or forwarding addresses may be shared legally with utility companies and Council Tax offices to ensure billing details are correct.
– If you default upon any tenancy conditions, information about you may be provided to authorised debt recovery agencies, to enable them to recover the debt. This may affect future applications for tenancies, credit and insurance.
– We may discuss your financial situation, rent payments (including any arrears) and any claims made for welfare benefits with; an external debt advice agency, welfare rights advisor, the housing benefit department or the local authorities housing advice and homeless prevention team to make sure that benefits are paid correctly.
– All current customers claiming housing benefit and Universal Credit (UC) their names, addresses and rent amounts are shared at the end of each year with local authority benefits teams and Dept. of Works & Pensions (DWP) to help claims for housing benefits and UC and so changes to housing benefits and UC happen more quickly and easily for everyone.
Accessing your information
Please contact us using your preferred contact method if you would like copies of some specific information from your files, and we will try to provide it as quickly as possible.
If you require a substantial amount of your personal information, there is a formal process for this, under the GDPR known as a Subject Access Request (SAR).
What you need to know about making a Subject Access Request:
You can write to us or email us with your request and you can post or email back to us. Please write to Data Protection Officer, Manningham Housing Association, Bank House, 30 Manor Row, BD1 4QE or email firstname.lastname@example.org.
We may require proof of your identity and address – we will let you know this when we receive your request.
We do not charge for the request.
When we receive your valid request – with proof of id/address if required – we will respond and provide your information within 30 calendar days at the latest.
You can request to see any of the information that we may hold about you, but the more specific you can be about what you require, the quicker we can respond to your request. Please be aware that we may need to edit some information out, if it relates to other people, as we must protect the privacy rights of all individuals.
If you have any queries about accessing your information please contact our Data Protection Officer.
Security of information
We use technology to ensure that our IT systems are secure. Security is reviewed with our IT supplier on a regular basis to ensure we meet our high standards of security. For further information on how we maintain the security of your information, please request our Data Protection and GDPR Policy.
Changes to our privacy notice
This privacy notice will be updated to reflect changes either to the way in which we operate or changes to the data protection legislation. To make sure that you keep up-to-date, we suggest that you revisit this notice from time-to-time.
How to contact us
If you have any queries about our website or about how we process data, please contact our Data Protection Officer on email@example.com.