Privacy Notice

This Privacy Notice explains how Poplar HARCA uses and protects your information.

What personal information do we collect?

Poplar HARCA is registered with the Information Commissioners Office.

We collect personal and sensitive information to deliver services.

When we ask you for information, we will tell you how we will use it.

We will use your information to verify who you are and manage our relationship with you. If you agree, we will also tell you about services, products, events, news or other information. If you do not agree, we will not send you this type of information.

How do we use your personal information?

We will collect, use and store information only when allowed for by the GDPR through:

  • Consent
  • Contract
  • Legal obligation
  • Legitimate interest
  • Public tasks
  • Vital interests

Examples of how information will be used include:

  • verify who you say you are to keep your data secure
  • allocate property
  • get feedback, such as on our services or as part of consultation for regeneration proposals
  • in response to requests allowed for by the GDPR e.g. Local Authority or Government agency
  • investigate complaints
  • manage tenancies  and leases
  • process rent, service and other charges
  • provide advice or support
  • provide education, employment and training advice
  • provide repairs and maintenance
  • provide services
  • research studies
  • recruitment and volunteering

Information will be shared with others only if:

  • another organisation is providing services as Poplar HARCA’s agent or contractor
  • the law says we have to e.g. safeguarding; or detection and prevention of crime
  • you have given permission
  • it is in our legitimate interest or in your legitimate interest

Who we may share your information with (please note this is not an exhaustive list):

  • London Borough of Tower Hamlets
  • Other landlords
  • Government and other regulatory bodies including elected officials
  • Police and other emergency services
  • Payroll and pensions providers
  • Utility companies
  • Insurance companies
  • Solicitors
  • Repairs contractors
  • Consultants
  • Auditors
  • Community support organisations
  • and other companies where we have a lawful basis or an exemption under GDPR

How long will we store information?

Poplar HARCA adopts The National Housing Federation’s Guidance on Document Retention


Our websites use Google Analytics to collect information about visitors.  This information is processed in a way that does not allow us to identify anyone.

Website forms

When you fill-in an online form, we may collect personal information so we can deal with the enquiry. Form submission data is not stored on the website server. This information is only stored on Poplar HARCA databases in line with the guidelines above.

Website Links

Clicking on a link to a different website means you leave our website. Each separate website should have a Privacy Notice.

Payments handling in the MyHARCA resident portal and our Payments webpage

The MyHARCA resident portal enables account holders to make payments against their accounts and resident forms. The payments functionality in MyHARCA is provided by Opayo Payment Gateway (formerly known as SagePay Payment Gateway). More information is available here.

The payments functionality in our payments page is also provided by Opaya Payment Gateway

When completing any transaction on the MyHARCA resident portal or our payments page, all personal payment information including card number, expiry date, and CVV are entered by the user via a secure connection directly to Opayo Payment Gateway for processing at the point of payment. Personal payment details are not cached, stored or handled by Poplar HARCA at any point of the transaction.

Telephoning us

When you phone Poplar HARCA we collect Calling Line Identification information, and the time and duration of the call. We also record some calls.  We use this information to help improve performance.

Translation services are provided by a third party which does not retain information from, nor record, calls.

Emailing us

Symantec Message Labs monitors and scans emails and attachments sent to us.  The email sender is responsible to ensure email and attachment contents comply with the law.

Complaints and enquiries

We will ask for information so we can investigate and respond to complaints and enquiries.

The information collected will be used to investigate and respond to complaints and enquiries.  It may be shared securely with:

  • Housing Ombudsman
  • officers investigating the complaint
  • officers responding to the complaint or enquiry
  • panel members (including a resident, or a Board or Committee member)
  • third parties (if we need information from one of our data processors)

Information related to a complaint will be retained securely for 7 years once the complaint has been closed.

We will assume your consent to share information with an elected Councillor or MP when they make an enquiry on your behalf.

Use of photos and videos

Poplar HARCA will often take photos and film at our public and private events. Photos taken at public events may be used for promotional purposes unless an individual informs us not to use imagery of either themselves or someone they are responsible for.

Photos taken at private events or specifically for the purpose of capturing images for promotional purposes will only be used with consent from those photographed or filmed. We will let you know why we’re capturing your image and how we may use it. You may revoke your consent at any time.

Using services

To provide services, or assess eligibility for a service, Poplar HARCA has to have information about you.

We will use (and sometimes share) information to provide services, or to assess your eligibility for a service e.g. providing contact details to a contractor who is carrying out a repair

If you agree, we will use your information to send you a survey about our services.  If you do not agree, we will not send you a survey.

Writing to us

When you write to us by post and use Royal Mail, it will be redirected to a company called CDP Print Management (CDP). CDP will collect, open and scan mail back to us.

CDP is an ISO accredited company and is registered as a data processor. CDP will ensure that all personal information is kept safe and passed on securely to Poplar HARCA. They will not hold on to any data longer than 30 days unless otherwise requested.

Any cherished items that get posted, such as passports and driving licences will be couriered back to the recipient. Read more about CDP’s privacy policy.

Utility Companies

To assist utility providers (gas, electricity and water) deliver their services and collect revenue, we will provide upon request names and addresses of new and existing tenants, and forwarding addresses for former tenants including tenancy dates. This is usually shared under our ‘legitimate business interests’ and legal obligations placed upon landlords.


We will upon request from our insurers provide names, address and contact details of tenants in order to aid the investigation and resolution of an insurance claim. This is shared under our legitimate business interest and contractual obligation.

Rental Exchange Scheme

We will share your tenancy information with Experian, including your track record for paying your rent, unless you tell us not to. The lawful basis under which we do this is legitimate interest. We will continue to exchange information about you with Experian while you have a relationship with us. We will also inform Experian when your tenancy has ended and if you have outstanding rental arrears Experian will record this outstanding debt. Experian will hold your rental data for the time limits explained in CRAIN (section 7). Rental data falls into the Identifiers (e.g. your name, address, date of birth) and financial account categories (i.e. tenancy account, rental payment information).


CCTV systems are used in our buildings and on our estates.  They are not usually monitored in real-time, but may be if an on-going incident is reported.

Footage is recorded over after 30 days. Downloads are restricted, but will be shared with the Police or other agencies for the purpose of preventing and detecting crime.  Downloaded images are securely stored and access is restricted.

Well One

Poplar HARCA partners with a number of local providers of wellbeing services as part of the ‘Well One’ social prescribing service. If you make use of this service, with your agreement, your contact details will be shared with relevant providers to enable you to sign-up to activities to help improve your health and wellbeing. This service is funded through grants and Poplar HARCA will create and receive information about how services are being used, but we will not obtain or share detailed information about your health or housing as part of the sign up process. Our legal basis for using and sharing information in connection with Well One is a mix of ‘contract’, ‘legitimate interests’ and ‘public interest’, and it is done with the agreement of the individuals who use Well One. It is envisaged that any data which we hold about individuals in connection with this service will be kept for about 6 years. You can find out more about the service and how it works by visiting the Well One website at

Internet of Things (IOT Devices) / Smart Home Devices

Poplar HARCA may install Smart Home/IOT Devices in your property. The smart home devices will primary gather data about your property and how it is used and will be provided to Poplar HARCA. The data generated will to help us manage your property and help us make better informed decisions about our buildings and the services we provide. The lawful basis for processing is our legitimate interests (article 6(1)(f) GDPR) which include:

  • Monitoring the conditions of properties
  • Reducing the costs and increasing the efficiency and effectiveness of reactive maintenance through timely identification and intervention of repairs and property related problems.
  • Gaining better knowledge of how properties are being used to assist with planned maintenance.
  • Optimising heating and other services for environmental benefits.

Whilst our general legal basis for processing will be under article 6(1)(f) GDPR, certain circumstances, the processing of data may be to protect tenants’ vital interests – for instance carbon monoxide monitoring, particularly in homes of vulnerable people. Our use of data may also be to inform or manage contracts with the data subject(s). For instance, data may indicate that a tenant is failing to keep a property in a reasonable condition/state of repair,

Residents who have devices fitted in their property will have access to the data through an app. All residents will be provided with an information pack on the devices, the data we collect, the purpose, who we share it with and how we secure the data.

Freedom of information

Poplar HARCA is not a prescribed organisation for the purposes of the Freedom of Information Act.  We do not share information requested under the Act’s provisions.

National Fraud Initiative

Poplar HARCA is obliged to protect public funds. We participate in the Cabinet Office’s National Fraud Initiative and provide information to the Minister for the Cabinet Office.  The information is used in a data matching exercise to assist in the prevention and detection of fraud. Data matching involves comparing computer records held by different organisations to see how far they match or identify potentially fraudulent claims and payments.

The use of shared information by the Cabinet Office is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require individual consent.  It is, however, subject to a Code of Practice which can be found online.

Continuous Recording of Social Housing Lettings and Sales (Core)

When you take out a new tenancy or buy a new property, we will share and have been sharing since 1998 your information with the Ministry of Housing, Communities & Local Government for research and statistical purposes. We do this through the Governments Core Website.

Core collects personal and sensitive information on the person and details of the property itself. This information may be shared by Core with other Government Departments and Agencies and this is only for research and statistical purposes.

If you have any questions, please contact

Job applicants, and current and former employees

Information provided when you apply for a job, will be used only for the purposes of the recruitment process, or to fulfil legal or regulatory requirements if necessary.  The information will be securely stored, access will be restricted and it will not shared with third parties, except for the purposes of preventing and detecting crime.

We may share employee information relating to former employees with prospective employers. This will only your start and end date and role you held with Poplar HARCA.

Application stage

We will ask you for contact details, work experience, education, referees and for answers to questions relevant to the role being applied for.

We will also ask for personal profile information such as ethnicity and religion.  You do not have to provide this information, and not providing the information will not affect your application.  Information you do provide will be used only for statistical analysis and you will not be identified.


Officers taking recruitment decisions will be provided with written applications.  They will not see personal profile information. When the recruitment process has completed, any copies of unsuccessful applications will be destroyed.


As well as interviews, recruitment processes may include assessment days; tests or occupational personality profile questionnaires; role play – or a combination of these.

If you are not appointed, 6 months after the recruitment decision information provided during the process will be destroyed.

Employment Offers

We are required to confirm the identity of the people who work for us, their right to work in the United Kingdom and seek assurance as to trustworthiness, integrity and reliability.

We will also ask for emergency contact and bank details.

This information will be securely stored, and access is restricted.

Disclosure and Barring Service

DBS criminal record check helps Poplar HARCA make safer recruitment decisions and prevent unsuitable people from working with vulnerable groups, including children, and or access to critical and highly sensitive business infrastructure.

We will share your personal information with the UK Umbrella Service Ltd. who are registered with the Disclosure Barring Service (DBS) to complete checks on Poplar HARCA’s behalf, and who will work with and share your information with agencies such as the DBS, Home Office and the Police Force in order to process your criminal record check. UK Umbrella Service Ltd.’s privacy notice can be accessed here.

You will upload your personal data onto the UK Umbrella Service Ltd.’s online platform. We will have access to, and UK Umbrella Service Ltd. will use the personal information that has been collected about you, to process a DBS Criminal Records check. Your personal information needs to be processed in this way to provide you with your DBS criminal record certificate.

Once your DBS check has been completed, the UK Umbrella Service Ltd. will issue you with a hard copy DBS criminal record certificate. Poplar HARCA will need to see the certificate once this has been received, to record the outcome.

A central register of DBS checks is recorded electronically on our computer system, which will include your name, job title, form reference, level of check and renewal date.

We will not use your data for any purpose other than the DBS check for which you have applied.

Occupational Health

When an employed is required to have a medical assessment (i.e. to review their fitness for work and obtain further information around their health and wellbeing), Poplar HARCA will share your personal information including sickness records and health conditions details to BHSF Occupational Health. Poplar HARCA will always notify you before sharing your personal information. Please note, information is shared via BHSF’s secure online portal. You can find out more abut their privacy notice by visiting the BHSF website.

Use of data processors 

Data processors are third parties who provide some recruitment and payroll services. We have contracts in place which mean they cannot do anything with your information without explicit permission for Poplar HARCA.

They will not share your information, and they will securely store it until instructed to destroy it.  If you are an employee or job applicant you can get a list of who we share your information with by emailing

We may also share your information with our auditors for monitoring and regulatory purposes.

How long is information retained for?

If you work for Poplar HARCA, your information will be retained for 6 years after you leave our employment.

If you apply for a job, but are not offered it, the information you provide will be retained for up to 6 months after the recruitment decision is made.

Anonymised personal profile information is retained indefinitely.

Recruitment decisions

Recruitment decisions are taken by team managers who consider all information collected during the application process.

Verbal feedback, available by emailing, will only be provided to shortlisted applicants.

Your rights

  • Right to be informed
  • Right to data portability
  • Right to erasure
  • Right to object
  • Right to rectification
  • Right to restrict processing
  • Rights related to automated decision making including profiling

You can access information we hold about you by making a ‘subject access request’.  The request must be in writing.

We will give you a copy of the information you request, explain why we have the information and who it may be shared with.  If there is any information we are not able to give you we will explain why.

Contact us

This privacy notice does not detail all of the types or uses of information.  If you have a specific question not covered in this notice, contact us: