Privacy Policy

General information – PRIVACY POLICY

Manningham Housing Association (MHA) Limited operates from Bank House, Manor Row, Bradford, BD1 4QE and is a provider of social housing to the communities of Bradford and Keighley.

MHA is the data controller as defined in the 2018 General Data Protection Regulations (UK GDPR).  The Data Privacy Manager for MHA can be contacted at dpm@manninghamha.co.uk

We are registered with the Information Commissioners Office under reference: Z728485X and we are open and transparent about the information we hold, why we hold it and for how long.

MHA generates records from our contact with you, including records of some personal information which is subject to UK GDPR.  We hold and process this information to fulfil our contract to you and facilitate our legitimate interests as a social landlord.

HOW SECURE IS THE INFORMATION?

We take information security very seriously and we use digital security technology to ensure that data is safe and secure. We ensure that third parties working with us adhere to the same high standards of security. Where information is held in paper files, we ensure safe physical protection of the records in locked filing cabinets and rooms. We also operate a clear desk policy to ensure that paperwork is not left on desks or information on computer screens whilst the member of staff is away.

COMPLAINTS OR ENQUIRIES

We take any complaints we receive about personal data processing very seriously. We welcome any suggestions for improving our procedures. If you do make a complaint or enquiry we may collect and store personal information in relation to this matter, which may include accessing CCTV or phone recordings. We will keep it secure and use it only for the purpose it was collected. When the matter is resolved or completed, we will retain the details in accordance with our retention schedule and then destroy them.

INFORMATION WE COLLECT VIA THE WEBSITE

We collect and store personal information via our website for several reasons including to help us provide better services and products to customers and potential customers. The information we collect fits into two categories:

1. Personal information entered via online forms or via our MHA chatbot by visitors to our website
2. Anonymous statistical information collected by cookies

If you request a repair, call back or information from us via an email, online form or register your interest in a service we will use your information to fulfil that request and delete it in line with our retention period once the request has been completed.

COOKIE USE

In order to provide you with the best experience, our website needs to place small text files, known as ‘cookies’, on your device. Most cookies we use are ‘session’ cookies and only exist for the time that you are using our site. They perform functional tasks – such as remembering that you are logged in as you move from page to page. We also track cookies anonymously for site analytics, to improve the user experience on our website and to make our products and services more relevant.

You can set your browser to reject all cookies, or alternatively, you will be asked when entering our website if you would like to accept or reject our cookies. Please note that if you do this then certain areas of this website will not be able to function for you.  To find out more, please see our Cookie Policy.

We also use technology that uses Internet Protocol (IP) information exchanges during the course of normal web activity combined with data-enhancement technology to get detailed analytics information. This only allows us to see how well our site is working and does not result in the collection of any personal data.

CCTV

Some of our schemes and offices have CCTV in public areas to deter crime and anti-social behaviour and to promote public safety by helping to identify and prosecute criminal offenders. You can ask for a copy of any CCTV images taken of yourself by making a ‘subject access request’. See Accessing your Information.

You can read the CCTV Policy here

 SHARING YOUR INFORMATION

Your personal information will be kept secure and confidential. Usually, we will not disclose personal data without consent but we may share information between the MHA group of companies such as:

• Contractors who deliver repairs and improvements (including our out-of-office providers)
• IT providers who manage our IT system and phones
• Training and Learning providers
• Distribution companies who help us to send our newsletter and other communications to you
• Third parties who help us to assess and manage our customer satisfaction
• Other agencies we work with, including Local Authorities, Social Services, Police, other social landlords and other agencies when MHA believes it is in your or the public’s interest to do so, or as required by law.

In particular, please be aware:

• Current or forwarding addresses may be shared legally with utility companies and Council Tax offices to ensure billing details are correct
• If you default upon any tenancy conditions, information about you may be provided to authorised debt recovery agencies, to enable them to recover the debt.  This may affect future applications for tenancies, credit and insurance
• We may discuss your financial situation, rent payments (including any arrears) and any claims made for welfare benefits with; an external debt advice agency, welfare rights advisor, the housing benefit department or the local authority’s housing advice and homeless prevention team to make sure that benefits are paid correctly
• All current customers claiming housing benefits and Universal Credit (UC) their names, addresses and rent amounts are shared at the end of each year with local authority benefits teams and Dept. of Works & Pensions (DWP) to help claims for housing benefits and UC and so changes to housing benefits and UC happen more quickly and easily for everyone

ACCESSING YOUR INFORMATION

Please contact us using your preferred contact method if you would like copies of some specific information from your files, and we will try to provide it as quickly as possible.

If you require a substantial amount of your personal information, there is a formal process for this, under UK GDPR known as a Subject Access Request (SAR).

What you need to know about making a Subject Access Request:

You can make a written or verbal request, however, we always recommend you make a written request so we can understand specifically what information is being asked for; please address written requests to our Data Privacy Manager at Manningham Housing Association, Bank House, 30 Manor Row, BD1 4QE or email dpm@manninghamha.co.uk.

• We may require proof of your identity and address – we will let you know this when we receive your request
• We do not charge for the request
• When we receive your valid request – with proof of ID/address if required – we will respond and provide your information within 30 calendar days unless the request is substantial, in this case, we may need to inform you that we require additional time to meet your request

You can request to see any of the information that we may hold about you, however, please be aware that we may need to edit some information, if it relates to other people, as we must protect the privacy rights of all individuals.

If you have any queries about accessing your information please contact our Data Privacy Manager.

SECURITY OF INFORMATION

We use technology to ensure that our IT systems are secure. Security is reviewed with our IT supplier on a regular basis to ensure we meet our high standards of security. For further information on how we maintain the security of your information, please review our MHA GDPR Policy.

CHANGES TO OUR PRIVACY NOTICE

This privacy notice will be updated to reflect changes either to the way in which we operate or changes to the data protection legislation. To make sure that you keep up to date, we suggest that you revisit this notice from time to time.

HOW TO CONTACT US

If you have any queries about our website or about how we process data, please contact our Data Privacy Manager at dpm@manninghamha.co.uk.

CUSTOMERS – PRIVACY POLICY

MHA generates records from our contact with you, including records of some personal information which is subject to UK GDPR. We hold and process this information to fulfil our contract to you and facilitate our legitimate interests as a social landlord.

WHO DOES THE PERSONAL INFORMATION RELATE TO?

Customers (tenants) This includes current, former and potential customers, who live in our properties and could also include their families and people associated with them.

Customers (non-MHA tenants)

This includes general members of the public, proprietors of a property

UK GDPR PROMOTES THE FOLLOWING PRINCIPLES:

• Processed lawfully, fairly and in a transparent manner
• Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes
• Adequate, relevant and limited to what is necessary for relation to those purposes
• Accurate and, where necessary, kept up to date
• Kept in a form which permits your identification for no longer than is necessary for those purposes.
• Processed in a way that ensures appropriate security of the data
• Accountability, MHA will be accountable for how we handle personal data

UK GDPR PROVIDES THE FOLLOWING RIGHTS FOR INDIVIDUALS:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision-making and profiling.

If you feel that any of your rights have been infringed, you have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk). Please review the details below to find out more.

HOW DO YOU USE MY RECORDS?

We will collect, process, share and securely store personal information in compliance and UK GDPR. We will use this information to fulfil our contract with you as a social landlord.

We keep these records to allow us to:

• Make allocations
• Manage tenancies
• Receive rent and service charges
• Provide a repairs and maintenance service
• Provide home ownership products
• Offer help with debts and benefits
• Prevent & detect crime and resolve disputes
• Promote safety and the quiet enjoyment of our neighbourhoods & communities
• Engage with customers and make improvements to our services
• Promote equal opportunities and fair treatment for all customers
• Provide information (e.g. about services) you request from us.

HOW LONG WILL YOU KEEP THE INFORMATION FOR?

All information will be retained in accordance with the requirements of our retention schedule which is based on the National Housing Federation’s (NHF) Retention Schedule guidelines. As a general rule, we hold personal information for as long as you have a contract with us, plus up to 6 years or 6 years after any arrears have been settled.

MHA Chat bot conversation history is kept on file for 12 months before the conversation is deleted.

“SENSITIVE” PERSONAL INFORMATION

Under UK GDPR certain personal information is classified as “sensitive”. Sensitive data is information relating to physical or mental health, sexual orientation, religious or philosophical beliefs, political opinions, membership of a Trade Union, and allegations of criminal offences and criminal convictions and offences.

We minimise our holding and use of sensitive categories of personal information but, given the services we provide, there are times when we use it, for example when providing accommodation for disabled persons, when resolving neighbourhood disputes involving alleged criminal activity or when helping someone to access care services.

When we collect specific sensitive data, we will notify you of how we will use it, including who it may be shared with

HOW DO WE COLLECT PERSONAL INFORMATION FOR TENANTS?

We collect information in a variety of ways including on various forms, tenancy agreements, and contracts; through our ongoing contact with you; in some cases, we collect CCTV images. Calls to and from our main office phones may be recorded.

When you apply to become an MHA customer, we request and hold on file any references necessary to assess your application including as appropriate (but not limited to):

• References from other housing providers/private landlords
• Your mortgage lender (if you own/have owned your own home)
• Agencies such as the Police, the Probation Service, support workers, social workers, mental health workers and
• Credit reference agencies.

If you provide us with personal information relating to members of your family or your associates you will need where appropriate their consent to the collection and processing of the information.

It is important that you notify us of any changes to your personal information you can do this by contacting our Customer Service team via email; receptiondesk@manninghamha.co.uk or telephone at 01274 771144

HOW SECURE IS THE INFORMATION?

We take information security very seriously and we use digital security technology to ensure that data is safe and secure. We ensure that third parties working with us adhere to the same high standards of security. Where information is held in paper files, we ensure safe physical protection of the records in locked filing cabinets and rooms. We also operate a clear desk policy to ensure that paperwork is not left on desks or information on computer screens whilst the member of staff is away.

COMPLAINTS OR ENQUIRIES

We take any complaints we receive about personal data processing very seriously. We welcome any suggestions for improving our procedures. If you do make a complaint or enquiry we may collect and store personal information in relation to this matter, which may include accessing CCTV or phone recordings. We will keep it secure and use it only for the purpose it was collected. When the matter is resolved or completed, we will retain the details in accordance with our retention schedule and then destroy them.

STAFF – PRIVACY POLICY

MHA generates records from our contact with you, including records of some personal information which is subject to UK GDPR.  We hold and process this information to fulfil our contract to you as your employer.

WHO DOES THE PERSONAL INFORMATION RELATE TO?

Colleagues (employees)
This includes current, former and potential colleagues, as well as Board and Committee members, apprentices and work experience students.

UK GDPR PROMOTES THE FOLLOWING PRINCIPLES:

• Processed lawfully, fairly and in a transparent manner
• Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes
• Adequate, relevant and limited to what is necessary for relation to those purposes
• Accurate and, where necessary, kept up to date
• Kept in a form which permits your identification for no longer than is necessary for those purposes
• Processed in a way that ensures appropriate security of the data
• Accountability, MHA will be accountable for how we handle personal data

UK GDPR PROVIDES THE FOLLOWING RIGHTS FOR INDIVIDUALS:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision-making and profiling.

If you feel that any of your rights have been infringed, you have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk).  Please review the details below to find out more.

HOW DO YOU USE MY RECORDS?

We will collect, process, share and securely store personal information in compliance and UK GDPR. We will use this information to fulfil our contract with you as your employer.

We keep these records to allow us to:

• Promote equal opportunities and fair treatment for all colleagues
• Provide employment and training advice and opportunities
• Manage employment and staff development
• Work with partners to deliver mutual success

HOW LONG WILL YOU KEEP THE INFORMATION FOR?

All information will be retained in accordance with the requirements of our retention schedule which is based on the National Housing Federation’s (NHF) Retention Schedule guidelines. As a rule, we hold personal information for up to 6 years.

“SENSITIVE” PERSONAL INFORMATION

Under UK GDPR certain personal information is classified as “sensitive”. Sensitive data is information relating to physical or mental health, sexual orientation, religious or philosophical beliefs, political opinions, membership of a Trade Union, and allegations of criminal offences and criminal convictions and offences.

We minimise our holding and use of sensitive categories of personal information but, given the services we provide, there are times when we use it, for example, collecting statistical data to monitor and maintain equality, diversity and inclusion at MHA.

When we collect specific sensitive data, we will notify you of how we will use it, including who it may be shared with.

HOW DO WE COLLECT PERSONAL INFORMATION FOR JOB APPLICANTS?

Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.

Once a person has taken up employment with MHA, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment and is outlined below.

HOW DO WE COLLECT PERSONAL INFORMATION FOR EMPLOYEES?

For employees we collect and hold on file:

• Job application form
• IT setup form for IT provider
• Right to Work documentation
• Starter form
• Letter of appointment
• Contract of employment
• Details to create an e-learning account
• Information for payroll to pay salaries
• Mobile phone information
• Essential car user driver details for insurance purposes and staff parking facilities
• Details for the swipe card system
• Details for healthcare provider
• Details for Pension provider
• Equality, Diversity and Inclusion monitoring data
• HMRC checklist details
• Information collected from the MHA website

Once employment with MHA has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it.  Further details for exactly what we hold, why we hold it and who it is shared with can be obtained from our HR department.

MHA will generate a record from our contact with you, which includes a record of necessary personal information which is subject to UK GDPR.

WHO DOES THE PERSONAL INFORMATION RELATE TO?

Customers (tenants)

This includes current customers, who live in our properties and their family and people associated with them.

UK GDPR PROMOTES THE FOLLOWING PRINCIPLES:

• Processed lawfully, fairly and in a transparent manner
• Collected only for legitimate purposes that have been clearly explained to you and not further processed in a way that is incompatible with those purposes
• Adequate, relevant and limited to what is necessary for relation to those purposes
• Accurate and, where necessary, kept up to date
• Retained for only a necessary period
• Processed in a way that ensures appropriate security of the data
• Accountability, MHA will be accountable for how we handle personal data

UK GDPR PROVIDES THE FOLLOWING RIGHTS FOR INDIVIDUALS:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision-making and

If you feel that any of your rights have been infringed, you have the right to lodge a complaint with the

Information Commissioner’s Office (www.ico.org.uk). Please review the details below to find out more.

WHY DOES MHA REQUIRE THIS DATA?

MHA requires data to assess if a child registered at MHA property, is eligible to participate in the Dolly Parton Imagination Library scheme.

It is necessary to obtain the obligatory data to fulfil the requirements of the contract with the Dollywood foundation ‘Dolly Parton Imagination Library’.

MHA does not collect extra personal data, instead clarifies the data MHA already holds on file and simultaneously obtains consent from the customer for the data to be internationally transferred to the Dollywood Foundation for processing in line with the Dolly Parton Imagination Library scheme.

WHAT HAPPENS IF I DON’T PROVIDE ALL THE DATA REQUESTED?

If a customer does not clarify all the necessary data held on their tenancy file and most importantly consent for the transfer of the necessary data required by the Dollywood Foundation, MHA will not be able to fulfil the contract on behalf of the customer and the customer will not be eligible by ‘default’ to benefit from the Dolly Parton Imagination Library.

HOW DO YOU USE THE DATA PROVIDED FOR THE DOLLY PARTON IMAGINATION LIBRARY?

MHA will collect, process, share and securely store personal information in compliance with UK GDPR. MHA only collects the necessary data held on file.

MHA will only apply the customer’s details via a secure electronic registration system which is maintained by the Dollywood Foundation if the customer has given consent for MHA to process the application on the customer behalf.

MHA will keep a database of the data submitted to the Dollywood Foundation to allow MHA to:

• Monitor who is eligible to participate in the Dolly Parton Imagination Library
• Process financial costs on behalf of an eligible customer

The Dollywood Foundation will provide a third-party distributor detail of each registered customer, to enable the foundation to fulfil its duties; providing customers with suitable merchandise. The foundation will manage the relationship with the third-party distributor and each party shall comply with UK data protection laws.

HOW LONG WILL YOU KEEP THE INFORMATION FOR?

Each eligible individual’s data shall be retained for no longer than 12 months after the first date the individual no longer meets the necessary requirements to benefit from the Dolly Parton Imagination Library scheme.