Privacy Notice

What personal information do we collect?

We are registered with the Information Commissioners Office.

We collect personal and sensitive information to deliver services.

When we ask you for information, we will tell you how we will use it.

We will use your information to verify who you are and manage our relationship with you. If you agree, we will also tell you about services, products, events, news or other information. If you do not agree, we will not send you this type of information.

The information we may hold about you includes:

• Name, date of birth, marital status, employment status, your residential status and benefit details
• Contact details – contact number, address, email address and next of kin information
• Your ethnicity, gender, race, religion, age, mental or physical health needs
• Criminal offence/conviction information
• Information about your training, qualifications and experience
• Images of you which are collected on our CCTV systems if you visit our offices or estates which have CCTV cameras in operation
• Telephone call recordings when you have contacted us or we have contacted you
• Your bank details and financial assessments
• Information about your views on our services where you have provided these to us
• Information obtained by the use of cookies when you visit our website
• Social media identifiers such as profile name, type of device and channel contacted, such as Facebook or Twitter.
• Any environmental sensors that you have consented to be used in your home such as temperature, humidity and air quality sensors

We collect your information in a variety of ways for example, when you:

• Contact us by telephone call, text, email or social media
• When you visit us in person
• Through consultations, door knocks, engagement events
• Complete a form, questionnaire, survey or give us feedback
• Use our services or our website or MyHARCA portal
• Access our virtual chat (Poppy) function on our website
• Through installed smart sensor capturing internal conditions in your home such as temperature, humidity and air quality

How do we use your personal information?

We will collect, use and store information only when allowed for by the General Data Protection Regulations (GDPR) through:

• Consent
• Contract
• Legal obligation
• Legitimate interest
• Public tasks
• Vital interests

Examples of how information will be used include:

• Verify who you say you are to keep your data secure
• Allocate property
• Get feedback, such as on our services or as part of consultation for regeneration proposals
• In response to requests allowed for by the GDPR e.g. from the local authority or Government agency
• Investigate complaints
• Manage tenancies  and leases
• Process rent, service and other charges
• Provide advice or support
• Provide education, employment and training advice
• Provide repairs and maintenance
• Provide services
• Research studies
• Recruitment and volunteering.

Information will be shared with others only if:

• Another organisation is providing services as Poplar HARCA’s agent or contractor
• The law says we have to e.g. safeguarding; or detection and prevention of crime
• You have given permission
• It’s in our legitimate interest or in your legitimate interest.

Who we may share your information with (please note this is not an exhaustive list):

• London Borough of Tower Hamlets
• Other landlords
• Government and other regulatory bodies including elected officials
• Police and other emergency services
• Payroll and pensions providers
• Utility companies
• Insurance companies
• Solicitors
• Repairs contractors
• Consultants
• Auditors
• Community support organisations
• and other companies where we have a lawful basis or an exemption under GDPR.

How long will we store information?

Poplar HARCA adopts The National Housing Federation’s Guidance on Document Retention

Websites

Our websites use Google Analytics to collect information about visitors.  This information is processed in a way that does not allow us to identify anyone.

Website forms

When you fill-in an online form, we may collect personal information so we can deal with the enquiry. Form submission data is not stored on the website server. This information is only stored on our databases in line with the guidelines above.

Website Links

Clicking on a link to a different website means you leave our website. Each separate website should have a privacy notice.

Payments handling in the MyHARCA resident portal and our Payments webpage

The MyHARCA resident portal enables account holders to make payments against their accounts and resident forms. The payments functionality in MyHARCA is provided by Opayo Payment Gateway (formerly known as SagePay Payment Gateway).

The payments functionality for our payments page is also provided by Opayo Payment Gateway.

When completing any transaction on the MyHARCA resident portal or our payments page, all personal payment information including card number, expiry date, and CVV are entered by the user via a secure connection directly to Opayo Payment Gateway for processing at the point of payment. Personal payment details are not cached, stored or handled by us at any point of the transaction.

Telephoning us

When you phone us, we collect Calling Line Identification information, and the time and duration of the call. We also record some calls.  We use this information to help improve performance.

Translation services are provided by a third party which does not retain information from, nor record, calls.

Emailing us

Symantec Message Labs monitors and scans emails and attachments sent to us.  The email sender is responsible to ensure email and attachment contents comply with the law.

Complaints and enquiries

We will ask for information so we can investigate and respond to complaints and enquiries.

The information collected will be used to investigate and respond to complaints and enquiries.  It may be shared securely with:

• The Housing Ombudsman
• Officers investigating the complaint
• Officers responding to the complaint or enquiry
• Panel members, including a resident, or a Board or Committee member
• Third parties, if we need information from one of our data processors.

Information related to a complaint will be retained securely for 7 years once the complaint has been closed.

We will assume your consent to share information with an elected councillor or MP when they make an enquiry on your behalf.

Satisfaction and feedback surveys

We carry out out a number of surveys throughout the year. The purpose of the surveys is to gather your views and feedback on us as your landlord, our services, events and specific projects and initiatives.

All surveys will be accompanied by a privacy notice informing you why we’re carrying out a survey, what information we’ll collect, how we will use your information, who we may share it with, how we store your data and the lawful basis we are relying on.

The surveys we regularly carry out includes

• Resident satisfaction survey / Annual TSM survey
• New home survey for when you move into a new home
• Satisfaction with our repairs service
• Satisfaction with our ASB service
• Consultation surveys on regeneration or specific services
• Contractor monitoring

There are different ways in which we carry out our surveys. They can be done online, text messaging, face to face, over the telephone, by post and social media. They are all voluntary surveys.

Most surveys will be anonymous where we will not collect or process personally identifiable information. Some surveys will ask for your demographic information (age range, gender, ethnicity, estate you live in etc) to help us analyse the representativeness of your feedback and to identify trends to improve our services. Other surveys will ask for your name and address, and may include a unique identifier where we will link your answers to your personal information. This will only be used to verify responses from our residents, to analyse and achieve representation and to comply with the regulatory requirements such as Tenant Satisfaction Measures. We do not store your feedback in your tenancy file unless we have your explicit consent for the purposes of improving our services to you.

Most of our surveys are conducted internally by our staff (data controller). We may sometimes use specialist third party survey companies (data processor) to conduct surveys on our behalf. This is usually a statutory or regulatory requirement, a funding criteria or where impartiality is required.  When we do this, we will ensure we have a data protection agreement in place with them and we will let you know.

The lawful basis for surveys we carry out include

• Statutory requirement (legal obligation)
• Legitimate interest.

In limited circumstances we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.

Any data shared will be aggregated and anonymised, ensuring your individual responses remain confidential. Data collected will be retained for as long as necessary to achieve the survey’s objectives. Once the purpose is fulfilled, all personal data will be securely deleted. We will not be transferring your information abroad. All information will be held in the UK and processed in accordance with the Data Protection Act 2018 and UK General Data Protection Regulation.

Use of photos and videos

We will often take photos and film at our public and private events. Photos taken at public events may be used for promotional purposes unless an individual informs us not to use imagery of either themselves or someone they are responsible for.

Photos taken at private events or specifically for the purpose of capturing images for promotional purposes will only be used with consent from those photographed or filmed. We will let you know why we’re capturing your image and how we may use it. You may revoke your consent at any time.

We and our contractors may also take before and after repairs photos of works carried out inside your home. This is so we can keep a record of the works completed, carry out quality checks or keep a record of why the work could not be carried out. All images are stored securely on our systems and only accessible by authorised members of staff. Our staff and contractors are trained to ensure only images of the area of your property related to the repair is taken. This information is processed under the Legitimate Interest lawful basis.

Using services

To provide services, or assess eligibility for a service, we have to store  information about you.

We will use (and sometimes share) information to provide services, or to assess your eligibility for a service e.g. providing contact details to a contractor who is carrying out a repair

If you agree, we will use your information to send you a survey about our services.  If you do not agree, we will not send you a survey.

Writing to us

When you write to us by post and use Royal Mail, it will be redirected to a company called CDP Print Management (CDP). CDP will collect, open and scan mail back to us.

CDP is an ISO accredited company and is registered as a data processor. CDP will ensure that all personal information is kept safe and passed on securely to us. They will not hold on to any data longer than 30 days unless otherwise requested.

Any cherished items that get posted, such as passports and driving licences will be couriered back to the recipient. Read more about CDP’s privacy policy.

Utility Companies

To assist utility providers (gas, electricity and water) deliver their services and collect revenue, we will provide upon request names and addresses of new and existing tenants, and forwarding addresses for former tenants including tenancy dates. This is usually shared under our ‘legitimate business interests’ and legal obligations placed upon landlords.

Insurers

We will upon request from our insurers provide names, address and contact details of tenants in order to aid the investigation and resolution of an insurance claim. This is shared under our legitimate business interest and contractual obligation.

Rental Exchange Scheme

We will share your tenancy information with Experian, including your track record for paying your rent, unless you tell us not to. The lawful basis under which we do this is legitimate interest. We will continue to exchange information about you with Experian while you have a relationship with us. We will also inform Experian when your tenancy has ended and if you have outstanding rental arrears Experian will record this outstanding debt. Experian will hold your rental data for the time limits explained in CRAIN (section 7). Rental data falls into the Identifiers (e.g. your name, address, date of birth) and financial account categories (i.e. tenancy account, rental payment information).

CCTV

CCTV systems are used in our buildings and on our estates.  They are not usually monitored in real-time, but may be if an on-going incident is reported.

Footage is recorded over after 30 days. Downloads are restricted, but will be shared with the Police or other agencies for the purpose of preventing and detecting crime.  Downloaded images are securely stored and access is restricted.

Well One

We partner with a number of local providers of wellbeing services as part of Well One, a social prescribing service. If you make use of this service, with your agreement, your contact details will be shared with relevant providers to enable you to sign-up to activities to help improve your health and wellbeing. This service is funded through grants and we will create and receive information about how services are being used, but we will not obtain or share detailed information about your health or housing as part of the sign up process. Our legal basis for using and sharing information in connection with Well One is a mix of ‘contract’, ‘legitimate interests’ and ‘public interest’, and it is done with the agreement of the individuals who use Well One. It is envisaged that any data which we hold about individuals in connection with this service will be kept for about 6 years.

Internet of Things (IOT) / Smart Home Devices

We may fit Smart Home/IOT Devices in your home. The data about your home gathered by the devices will be provided to us. The data generated will help us look after your home and make better informed decisions about the buildings and the services we provide. The lawful basis for processing is our legitimate interests (article 6(1)(f) GDPR) which include:

• Monitoring the conditions of properties
• Reducing the costs and increasing the efficiency and effectiveness of reactive maintenance through timely identification and intervention of repairs and property related problems.
• Gaining better knowledge of how properties are being used to assist with planned maintenance.
• Optimising heating and other services for environmental benefits.

Whilst our general legal basis for processing will be under article 6(1)(f) GDPR, certain circumstances, the processing of data may be to protect tenants’ vital interests – for instance carbon monoxide monitoring, particularly in homes of vulnerable people. Our use of data may also be to inform or manage contracts with the data subject(s). For instance, data may indicate that a tenant is failing to keep a property in a reasonable condition/state of repair,

Residents who have devices fitted in their home will have access to the data through an app. All residents will be provided with an information pack on the devices, the data we collect, the purpose, who we share it with and how we secure the data.

Freedom of information

We are not a prescribed organisation for the purposes of the Freedom of Information Act.  We do not share information requested under the Act’s provisions.

National Fraud Initiative

We are  obliged to protect public funds. We participate in the Cabinet Office’s National Fraud Initiative and provide information to the Minister for the Cabinet Office.  The information is used in a data matching exercise to assist in the prevention and detection of fraud. Data matching involves comparing computer records held by different organisations to see how far they match or identify potentially fraudulent claims and payments.

The use of shared information by the Cabinet Office is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require individual consent.  It is, however, subject to a Code of Practice which can be found online.

Continuous Recording of Social Housing Lettings and Sales (Core)

When you take out a new tenancy or buy a new property, we will share and have been sharing since 1998 your information with the Ministry of Housing, Communities & Local Government for research and statistical purposes. We do this through the Governments Core Website.

Core collects personal and sensitive information on the person and details of the property itself. This information may be shared by Core with other Government Departments and Agencies and this is only for research and statistical purposes.

If you have any questions, please email dataprotection@communities.gsi.gov.uk

Job applicants, and current and former employees

Information provided when you apply for a job, will be used only for the purposes of the recruitment process, or to fulfil legal or regulatory requirements if necessary.  The information will be securely stored, access will be restricted and it will not shared with third parties, except for the purposes of preventing and detecting crime.

We may share employee information relating to former employees with prospective employers. This will only be for your start and end date for role you held with Poplar HARCA.

Application stage

We will ask you for contact details, work experience, education, referees and for answers to questions relevant to the role being applied for.

We will also ask for personal profile information such as ethnicity and religion.  You do not have to provide this information, and not providing the information will not affect your application.  Information you do provide will be used only for statistical analysis and you will not be identified.

Shortlisting

Officers taking recruitment decisions will be provided with written applications.  They will not see personal profile information. When the recruitment process has completed, any copies of unsuccessful applications will be destroyed.

Assessments

As well as interviews, recruitment processes may include assessment days; tests or occupational personality profile questionnaires; role play – or a combination of these.

If you are not appointed, 6 months after the recruitment decision information provided during the process will be destroyed.

Employment Offers

We are required to confirm the identity of the people who work for us, their right to work in the United Kingdom and seek assurance as to trustworthiness, integrity and reliability.

We will also ask for emergency contact and bank details.

This information will be securely stored, and access is restricted.

Disclosure and Barring Service

DBS criminal record check helps Poplar HARCA make safer recruitment decisions and prevent unsuitable people from working with vulnerable groups, including children, and or access to critical and highly sensitive business infrastructure.

We will share your personal information with the UK Umbrella Service Ltd. who are registered with the Disclosure Barring Service (DBS) to complete checks on Poplar HARCA’s behalf, and who will work with and share your information with agencies such as the DBS, Home Office and the Police Force in order to process your criminal record check. UK Umbrella Service Ltd.’s privacy notice can be accessed here.

You will upload your personal data onto the UK Umbrella Service Ltd.’s online platform. We will have access to, and UK Umbrella Service Ltd. will use the personal information that has been collected about you, to process a DBS Criminal Records check. Your personal information needs to be processed in this way to provide you with your DBS criminal record certificate.

Once your DBS check has been completed, the UK Umbrella Service Ltd. will issue you with a hard copy DBS criminal record certificate. Poplar HARCA will need to see the certificate once this has been received, to record the outcome.

A central register of DBS checks is recorded electronically on our computer system, which will include your name, job title, form reference, level of check and renewal date.

We will not use your data for any purpose other than the DBS check for which you have applied.

Occupational Health

When an employed is required to have a medical assessment (i.e. to review their fitness for work and obtain further information around their health and wellbeing), Poplar HARCA will share your personal information including sickness records and health conditions details to BHSF Occupational Health. Poplar HARCA will always notify you before sharing your personal information. Please note, information is shared via BHSF’s secure online portal. You can find out more abut their privacy notice by visiting the BHSF website.

Use of data processors 

Data processors are third parties who provide some recruitment and payroll services. We have contracts in place which mean they cannot do anything with your information without explicit permission for Poplar HARCA.

They will not share your information, and they will securely store it until instructed to destroy it.  If you are an employee or job applicant you can get a list of who we share your information with by emailing dataprotection@poplarharca.co.uk.

We may also share your information with our auditors for monitoring and regulatory purposes.

How long is information retained for?

If you work for us, your information will be retained for 6 years after you leave our employment.

If you apply for a job, but are not offered it, the information you provide will be retained for up to 6 months after the recruitment decision is made.

Anonymised personal profile information is retained indefinitely.

Recruitment decisions

Recruitment decisions are taken by team managers who consider all information collected during the application process.

Verbal feedback, available by emailing recruitment@poplarharca.co.uk, will only be provided to shortlisted applicants.

Your rights

• Right to be informed
• Right to data portability
• Right to erasure
• Right to object
• Right to rectification
• Right to restrict processing
• Rights related to automated decision making including profiling

You can access information we hold about you by making a ‘subject access request’.  The request must be in writing.

We will give you a copy of the information you request, explain why we have the information and who it may be shared with.  If there is any information we are not able to give you we will explain why.

Contact us

This privacy notice does not detail all of the types or uses of information.  If you have a specific question not covered in this notice, contact us:

• 0800 035 1991
• dataprotection@poplarharca.co.uk
• Nazmul Ahmed, Data Protection Officer

NHF GuidanceOpayoOur payments page Well OneBHSF